Amadeus data breach spreads as airlines reveal passenger exposure - TravelMole

The incident involves unauthorized access to reservation data held on Amadeus systems, rather than breaches of the airlines’ own IT networks. The information potentially exposed includes passenger names, booking references, travel itineraries and, in some cases, passport details, contact information and frequent-flyer numbers.

The period under investigation runs from August 10, 2023, to September 23, 2026. New disclosures are continuing more than a week after the first carriers alerted customers, raising questions about the full scale of the breach and the security of airline reservation technology.

Asian carriers are the most affected so far. The first public disclosures came on October 23, when Korean Air and Asiana Airlines confirmed they had been notified by Amadeus of unauthorized access. Both airlines said they had received notification on October 20. Korean Air confirmed that booking reference numbers had been exposed, while Asiana said reservation information was involved. Neither reported an intrusion into its own systems.

Japan Airlines (JAL) and Japan Transocean Air disclosed the incident on October 30, reporting approximately 92,000 affected customers. Around 90,000 had booking references, names, travel dates, flight sectors and cabin classes potentially accessed. For another 2,000, additional information including passport numbers, telephone numbers and frequent-flyer details may have been exposed. All Nippon Airways (ANA) also announced on October 30 that 37,800 customers were affected.

Cathay Pacific published its disclosure on October 30, reporting approximately 53,000 affected bookings. Malaysia Airlines followed on October 31, warning that customer information processed through Amadeus between August 2023 and September 2026 might have been compromised, although it did not initially provide a total.

The list continued to grow in November. Singapore Airlines announced on November 3 that approximately 46,000 booking records had been accessed. In around 620 cases, additional information including email addresses, telephone numbers, travel document details and KrisFlyer membership numbers may have been exposed. Bangkok Airways issued a warning on November 6, while Finnair and Thai Airways International disclosed their exposure on November 9.

Finnair reported approximately 116,000 reservations involved in the breach, of which around 750 had been opened for examination. Thai Airways identified 60,529 potentially accessed passenger records, including 376 containing additional personal information.

Amadeus issued a statement in October acknowledging a vulnerability affecting a travel booking display environment. It confirmed that certain booking information had been accessible but said there was no evidence that payment or financial data had been accessed. It also reported no indications of ransomware activity.

The company said it had fixed the vulnerability, introduced enhanced monitoring and detection measures, and was communicating directly with customers and authorities. It has not publicly disclosed the total number of affected passengers or airlines.

The investigation could extend further. Qantas has confirmed that it is working with Amadeus to establish whether its bookings were affected. According to Amadeus, more than 200 airlines use its reservation systems. However, this does not mean that all these carriers had their data exposed as the breach involves a specific reservation display environment. Amadeus has so far not published a complete list of airlines whose records may have been accessed.