Amadeus Breach: Three Years of Unnoticed Access to Airline Booking Data and the System Account Behind It

For more than three years, someone was able to read airline booking records held by one of the travel industry's most important technology suppliers, and nobody noticed. That is the picture emerging from a run of airline disclosures that began in South Korea on 23 October 2026 and reached Singapore Airlines on 3 November. The supplier is Amadeus IT Group, the Madrid-based company whose reservation, ticketing and check-in platforms are used by hundreds of airlines and airports.

Amadeus has said very little. Its airline customers have said rather more, and the detail they have published turns a routine third-party breach notice into a case study in two things most organisations handle badly: the credentials used by systems rather than people, and the length of time an intruder can stay if nobody is watching those credentials.

What Happened

Amadeus's public statement, dated only "October 2026", runs to six sentences. The company "became aware of a vulnerability affecting a travel booking display environment" and "certain booking-display data was accessible through the vulnerability". It says there is "no evidence that payment or financial data was accessed" and no indication of ransomware, that it has fixed the vulnerability and enhanced its monitoring and detection, and that it is "in direct dialogue with our customers and authorities". It gives no dates, no numbers and no airline names, and it declined to tell The Record how many customers were affected or whether the attackers had made contact.

The airlines fill in the gaps. Cathay Pacific's notice says Amadeus told it on 28 October of "unauthorised access to travel reservation data" in Amadeus's systems, in which an unauthorised party used "login credentials assigned to its system account". The access took place between August 2023 and September 2026. Amadeus told Cathay it had contained the incident, including with a password reset. Asiana Airlines gives the same account of system account credentials, according to a comparison of the notices by Brandefense. Japan Airlines is more precise about the window: traces of external access were identified from 10 August 2023 to 23 September 2026.

The two descriptions, a vulnerability in a display environment and the misuse of a system account's credentials, have not been reconciled publicly. They may be two views of the same weakness. Until Amadeus says more, it is fair only to note that the supplier and its customers are describing the incident in different terms.

The Disclosures So Far

Notifications went out in stages. According to Aviation Today's timeline, Amadeus told Korean Air and Asiana late on 20 October, and both published customer notices on 23 October and reported the incident to South Korea's Personal Information Protection Commission. Japan Airlines and its subsidiary Japan Transocean Air were informed on 23 October and disclosed on 28 October that about 92,000 customers were affected. For roughly 90,000 the data was a reservation code, name, flight date, sector and class of service; for about 2,000 it also included email address, phone number, passport number, nationality, frequent flyer number, ticket number and seat number.

All Nippon Airways followed on 29 October with about 37,800 customers, and its partner carriers Star Flyer, AIRDO and Solaseed Air issued notices of their own. Cathay Pacific put its figure at about 53,000 bookings. Malaysia Airlines issued an advisory on 31 October without a number. On 3 November Singapore Airlines said about 46,000 booking records may have been affected, of which around 620 also included email addresses, phone numbers, travel document details and KrisFlyer membership numbers, Reuters reported. It is contacting customers with upcoming travel to change their booking references. Qantas says Amadeus has advised that the issue was contained in September and that it is working to understand the impact on its bookings. The Cyber Express counts at least 15 carriers confirmed or under investigation across Asia, Europe and Australia, including the German leisure airline Condor.

Every airline says its own systems were not breached and that flights were unaffected. Those that address the point say they have seen no evidence that the data has been misused.

Who Is Affected

The four headline figures published so far add up to roughly 228,800, but they count different things, customers in some cases and bookings in others, and several airlines have given no number at all. The total will rise. None of the airline notices we reviewed came from a UK carrier, and the confirmed disclosures are concentrated in Asia, with one European airline named in trade reports. Passengers of any nationality who flew with the affected airlines during the three-year window may be included.

For most people the exposed data is a name, a booking reference and a flight. That sounds modest, but a surname and a booking reference are exactly what airline websites ask for before showing or changing a reservation, which is why Singapore Airlines is replacing references for future travel. The same details make a phishing message far more convincing: an email that quotes your real flight and reference and asks you to confirm a schedule change or pay a fee is hard to tell from the genuine article. For the smaller groups whose passport numbers, contact details and frequent flyer numbers were exposed, the risks extend to identity fraud and loyalty account takeover.

Business travel adds another layer. Itineraries reveal who is meeting whom and where, and corporate travel teams, executive assistants and travel management companies are natural targets for an attacker holding accurate booking data.

Why It Matters

Three years is the number that should worry security leaders. Whatever the precise mechanism, access that began in August 2023 was not identified until September 2026. Credentials assigned to systems rather than people are particularly prone to this. They tend to have broad, standing access, they cannot use multi-factor authentication in the usual way, their passwords are changed rarely if at all because changing them risks breaking something, and their activity looks like normal machine traffic. We have written before about why non-human identities are a security blind spot; if the airlines' account is right, this incident is an example from a mature, well-resourced technology company.

The second issue is concentration. Airlines compete with each other but share a small number of reservation platforms, so a weakness at one supplier becomes a breach at a dozen customers at once. The same is true of payroll providers, managed file transfer tools, customer relationship platforms and the specialist software each sector depends on. None of the affected airlines could have detected this from inside its own network, because nothing happened inside its own network.

The third is the notification chain. Qantas says it was told the issue was contained in September. The first airline notifications reported so far are dated 20 October, and others followed over the next nine days. Under the GDPR a processor must tell its customers about a personal data breach without undue delay, and each airline then has its own regulators and passengers to inform. Supplier contracts that are vague about how quickly, and in how much detail, a provider must report an incident leave the customer explaining a breach it knows little about.

What To Do Now

Inventory your system and service accounts. List every account used by an application, integration, script or supplier rather than a named person. Record what each can reach, who owns it and when its credential was last changed. Expect to find accounts nobody can explain.

Rotate, vault and restrict them. Move credentials into a secrets vault, rotate them on a schedule, replace static passwords with short-lived tokens or certificates where the technology allows, and limit each account to the systems and network locations it needs.

Monitor what they do. A service account that suddenly reads far more records, connects from a new location or works outside its usual pattern should raise an alert. Keep the logs long enough to investigate. An intrusion that lasts three years cannot be reconstructed from ninety days of retention.

Ask your suppliers the same questions. For each provider that holds your customers' data, ask how system accounts are credentialed, rotated and monitored, how long access logs are kept and how quickly you would be told about unauthorised access. Write the answers into the contract.

Brief travellers and travel bookers. Tell staff who fly, and those who book for them, that messages quoting real booking details may be fraudulent. Changes and payments should be made only through the airline's own app or website or your travel management company.

If you are a passenger of an affected airline, follow its notice, accept a new booking reference if one is offered and check your frequent flyer account.

How Cybergen Can Help

Cybergen's identity security and privileged access management service helps organisations find, vault and monitor system and service accounts. Our third-party and supply chain risk management team can review what your key suppliers hold and how they would tell you about a breach, and our security awareness and phishing simulation service prepares staff for messages built from real stolen data.

Frequently Asked Questions