Amadeus Data Breach: Which Airlines Are Affected and What Was Exposed
Someone used an Amadeus system account's login for three years to read airline booking records. Here is every airline named so far, how many customers, what data was exposed, and how to spot the fake refund and booking-change messages that follow a breach like this.
Quick answer: As of 2 November 2026, Japan Airlines (about 92,000 customers), ANA (about 37,800), Cathay Pacific (about 53,000 bookings), Korean Air, Asiana and Malaysia Airlines have said customer data was exposed through Amadeus, and Qantas is still checking its bookings. Most records held a booking reference, name and flight details; a smaller group also had email, phone, passport or frequent flyer numbers, and no airline has reported card or payment data taken.
Key takeaways
- What happened: an unauthorised party used login credentials assigned to an Amadeus system account to read airline reservation data between August 2023 and September 2026, Cathay Pacific said.
- Biggest confirmed numbers: Japan Airlines about 92,000 customers, Cathay Pacific about 53,000 bookings, ANA about 37,800 customers.
- Passports: about 2,000 JAL customers and about 1,700 ANA customers also had passport numbers and contact details viewed.
- No payment data reported: JAL and ANA say no card numbers or passwords; Cathay, Asiana and Malaysia Airlines say there is no evidence financial or payment data was accessed.
- The real risk now is phishing: a scammer who knows your real booking reference can write a very convincing refund or schedule-change message.
If your phone buzzes with a text that quotes your real booking code and offers a refund, pause. This week a string of Asian and Pacific airlines confirmed that passenger booking records were read inside Amadeus, the Spanish company that runs reservation and check-in systems for hundreds of airlines. Searches for "airlines affected by amadeus breach" jumped in Australia after Qantas spoke on Sunday. Here is what is confirmed, checked against airline statements and reporting by NZ Herald, Bloomberg, The Korea Times, The Edge Malaysia and Aviation Wire, as of 2 November 2026.
Which airlines are affected by the Amadeus breach?
Seven airline groups have said so publicly, and more may follow because Amadeus serves carriers worldwide. The table shows what each one has said as of 2 November 2026.
| Airline | How many | What was exposed |
|---|---|---|
| Japan Airlines and Japan Transocean Air | About 92,000 customers | About 90,000: booking number, name, travel date, route, cabin. About 2,000 also: email, phone, passport number, nationality, mileage number, ticket and seat. No card numbers or passwords. |
| Cathay Pacific | About 53,000 bookings (not people) | Mostly booking reference, name, flight details. A smaller subset: email, phone, travel document and/or frequent flyer number. No evidence of payment data. |
| ANA | About 37,800 customers | About 36,100: name, booking reference, date, route, cabin. About 1,700 also: email, phone, passport number, nationality, mileage number. No card details or passwords. |
| Korean Air | Not disclosed | Some booking reference numbers. No sign its own systems were breached. |
| Asiana Airlines | Not disclosed | Reservation information. Payment data not affected (handled in a separate system). |
| Malaysia Airlines | Not disclosed | Some customer information processed via Amadeus, August 2023 to September 2026. No evidence financial data was accessed. |
| Condor | Not disclosed | Said its data was affected (Bloomberg). No detail yet. |
| Qantas | Still assessing | Amadeus told Qantas of unauthorised access; Qantas is checking the impact on any Qantas bookings. |
Air Do, Solaseed Air and Starflyer, which reach Amadeus through ANA, were also notified and are checking their records, Aviation Wire reported. Air New Zealand told NZ Herald: "At this stage, we don't believe we are impacted."
What happened at Amadeus, and when?
According to Cathay Pacific's statement of 30 October 2026, an unauthorised party used "login credentials assigned to its system account" to reach travel reservation data in Amadeus's systems between August 2023 and September 2026. The Korea Times gave the same explanation for Korean Air and Asiana. Amadeus said it had become aware of a "vulnerability affecting a travel booking display environment", The Edge Malaysia reported.
- 24 September 2026: Amadeus detected the intrusion, ANA said, according to Aviation Wire.
- Containment: Amadeus reset the password, disabled the credentials and added monitoring, Cathay and ANA said. Qantas said Amadeus told it the issue "was contained in September".
- 20 to 28 October: airlines were told one by one. ANA heard on 20 October, JAL on 23 October and Cathay on 28 October.
- Misuse: "Amadeus has not identified evidence that the affected data has been misused," Cathay said.
One clarification for anyone searching: older headlines from January 2019 about an Amadeus booking flaw describe a separate, earlier issue, not this incident.
Was Qantas affected by the Amadeus breach?
Not confirmed yet. On 1 November Qantas said Amadeus had told it of unauthorised access to one of its systems and that it was working with Amadeus to understand the impact on any Qantas bookings, NZ Herald reported. Qantas added: "There is no impact to Qantas systems or databases, which remain secure." It has alerted the Australian Cyber Security Centre and the Office of National Cyber Security. This is a different incident from the July 2025 Qantas contact-centre breach.
Was my credit card or passport exposed?
Card data: no airline has reported it. JAL and ANA say no card numbers or passwords were included, and Cathay, Asiana and Malaysia Airlines say there is no evidence that payment or financial information was accessed. Passport numbers: yes, but only for a small group, about 2,000 JAL customers and about 1,700 ANA customers, and Cathay lists travel document details for a smaller subset of its 53,000 bookings.
The airlines say they will contact affected customers individually. ANA said it would start the week after its 30 October announcement and told customers to be wary of emails, calls, websites and social media ads pretending to be ANA.
What should you do if you flew with these airlines?
The data that leaked is exactly what a scammer needs to sound real: your name, your booking code, your route. Malaysia Airlines urged customers to "remain vigilant against suspicious or unsolicited communications". In practice:
- Distrust messages that quote your booking reference. A real code in a text or email no longer proves it came from the airline.
- Ignore unexpected refund, compensation or rebooking offers. Breaches are followed by fake refund and schedule-change messages linking to lookalike sites that ask for card details.
- Never pay to fix a booking from a link. If a message says a payment failed or a seat is at risk, close it and open the airline's official app or type its web address yourself.
- Lock down loyalty accounts. Some frequent flyer numbers were exposed. Change a reused password and turn on two-step verification where the programme offers it.
- Check only in the official app. Real refunds and schedule changes show there.
- Watch your phone number too. Leaked phone numbers feed SIM-swap attempts; our guide to the SIM swap and eSIM swap scam explains the warning signs.
Airports are a favourite stage for this kind of pressure, with fake helpers and urgent rebooking offers; see airport scams to avoid in 2026.
Is the "Frontier refund scam" linked to Amadeus?
There is no evidence of that. "Frontier refund scam" is a breakout search this week. On 1 November the consumer site Online Threat Alerts described emails to Frontier Airlines passengers that used real names and trip details, offered a "billing and adjustment refund" and led to a lookalike Frontier domain asking for card details. No major outlet has confirmed it, and Frontier is not named in the Amadeus incident. The pattern is the same, though: real trip details, a refund lure, a link. Treat any refund you did not request as fake until the official app shows it.
Why does being online when you land help?
Scam texts land when you are tired and offline: roaming off, a "failed payment" on your connection. Without data the link is the only thing in front of you. With a travel eSIM installed before you fly, you are online at touchdown and can check the claim in the official app at once.
Fizen is building the stablecoin neobank for people on the move: a self-custody wallet, local QR payments, investing and travel data in one app. The Fizen travel eSIM covers 150+ countries, can be paid with USDT on Solana or BNB Chain or by card via Stripe, and comes with real people on support. Buy only from a provider you can reach; our guide to eSIM scams shows the fake eSIM shops to avoid.
Frequently asked questions
Which airlines are affected by the Amadeus breach?
As of 2 November 2026, Japan Airlines and Japan Transocean Air, ANA, Cathay Pacific, Korean Air, Asiana, Malaysia Airlines and Condor have said data was affected. Qantas is still assessing whether any of its bookings were involved.
How many people were affected by the Amadeus breach?
No overall total has been published. JAL reported about 92,000 customers, Cathay Pacific about 53,000 bookings and ANA about 37,800 customers; the others have not given figures.
What data was stolen in the Amadeus breach?
Mostly booking references, passenger names and flight details. A smaller group also had email, phone, passport number, nationality or frequent flyer numbers exposed, and no airline has reported card or payment data taken.
How did the Amadeus breach happen?
Cathay Pacific said an unauthorised party used login credentials assigned to an Amadeus system account to access reservation data between August 2023 and September 2026. Amadeus reset the password and added monitoring.
Is Qantas affected by the Amadeus breach?
Not confirmed. Qantas said on 1 November 2026 it was working with Amadeus to understand the impact on any Qantas bookings and that its own systems remain secure.
Should I cancel or change my booking?
No airline has advised that. Keep your booking, check it only in the airline's official app, and ignore refund or rebooking messages you did not ask for.
Your travel eSIM gift is waiting: US$10 of eSIM credit
New users get US$10 of eSIM credit in the Fizen app's eSIM tab. It comes off the bill automatically at checkout, up to 30% of each plan, no code needed. Travel eSIM in 150+ countries, paid with USDT or by card. fizen.io/esim works too.
Terms and conditions
- Information only. This article summarises a developing news story from airline statements and news reports as of 2 November 2026. Figures and the list of affected airlines may change. It is not legal, financial or security advice, and not an offer or sale of any product.
- For readers in the United States. This is information only, not an offer or sale, and not advice. Fizen products and services are not offered to US Persons.
- Independent, with one disclosure. Fizen is not affiliated with Amadeus or any airline named here. Tether has made a strategic investment in Fizen. Facts are as stated in the sources listed below.
- eSIM credit. The US$10 eSIM credit is a promotional discount for new users in the Fizen app's eSIM tab, usable for up to 30% of each plan, not cash and not transferable. Full terms: docs.fizen.io/help-center/fizen-esim/welcome-credit.
- Image. Banner photo: Japan Airlines Boeing 787-9 JA876J at Taipei Songshan, by 4300streetcar, Wikimedia Commons, CC BY 4.0 (creativecommons.org/licenses/by/4.0), cropped and combined with a text panel. Airline names and liveries are trademarks of their owners and are used for news identification only.
Sources
- Cathay Pacific, Personal data security incident involving a third-party service provider, 30 October 2026
- NZ Herald, Airlines including Qantas, Cathay Pacific impacted in Amadeus cyber attack, 2 November 2026
- The Edge Malaysia, Malaysia Airlines says customers may be affected by Amadeus breach, 1 November 2026
- New Straits Times, Malaysia Airlines' systems untouched by data breach, 2 November 2026
- The Star (Bloomberg), Cathay Pacific joins growing list of airlines hit by data breach, 30 October 2026
- The Korea Times, Korean Air breach exposes blind spot in airline cybersecurity, 25 October 2026
- Aviation Wire, JAL and JTA: Amadeus unauthorised access, about 92,000 customers, 28 October 2026 (Japanese)
- Aviation Wire, ANA: about 37,800 customers, 30 October 2026 (Japanese)
- The Record, Japan Airlines warns of breach, 28 October 2026
- Online Threat Alerts, Frontier Airlines scam email, 1 November 2026 (single source, not confirmed by major outlets)
Developing story. Checked against Cathay Pacific's statement, NZ Herald, The Edge Malaysia, Bloomberg via The Star, The Korea Times and Aviation Wire on 2 November 2026.
