Amadeus Data Breach Affected Airlines Explained: Qantas, JAL, Cathay, ANA and What India Flyers Should Do

UPDATE — 10 November 2026: SAS has confirmed that booking information for 350,164 travellers may have been exposed in the same Amadeus incident — the largest single-airline figure disclosed so far. Finnair says about 116,000 of its reservations may be affected, and Norwegian and travel agency Berg-Hansen have also reported the incident to Norway's data protection authority. Norway's National Security Authority says an unauthorised actor may have had access to Amadeus systems for at least three years, with the vulnerability closed on 23 September 2026. The SAS data involved is booking references, dates, flight details and passenger numbers — mostly older bookings and completed journeys — and SAS says it has not identified further categories of personal data in its records so far. Amadeus says there is no evidence so far that payment or financial data was accessed, and the investigation continues. (Sources: SVT, Finnair, Norwegian National Security Authority.)

Illustrative image: an airport departure board. The Amadeus breach exposed passenger booking records, not a single airport or airline system — no photo of the breach itself exists. Image: Wikimedia Commons.

UPDATE — 10 November 2026: Thai Airways has now confirmed that about 60,529 of its passenger booking records were accessed in the same Amadeus breach, with a further 376 records possibly affected — some of those may include passport numbers, email addresses and phone numbers. Credit card details were not affected, Thai Airways' own systems were not breached, and affected passengers will be notified individually. Thai Airways joins Cathay Pacific, Japan Airlines, ANA, Quantas and Malaysia Airlines among the carriers confirming exposure. Source: Thai Airways statement, reported by Khaosod English, 10 Nov 2026.

TL;DR — Amadeus data breach affected airlines explained: unauthorised access to the travel-tech giant's booking systems exposed passenger records from August 2023 to September 2026. Cathay Pacific, Japan Airlines, ANA, Qantas and Malaysia Airlines are among the carriers confirming exposure — but no payment or financial data was accessed, and no misuse has been found so far.

📌 KEY HIGHLIGHTS

• What happened: unauthorised access to an Amadeus booking system using valid login credentials, running from August 2023 until it was contained in September 2026.
• Who confirmed exposure: Cathay Pacific (~53,000 bookings), Japan Airlines (~92,000 customers), ANA (~37,800 customers), Thai Airways (~60,529 booking records), plus Qantas, Malaysia Airlines, Korean Air, Asiana, Singapore Airlines and Condor.
• What leaked: mostly names, booking references and flight details — but for a smaller group, passport numbers, phone numbers and frequent-flyer details too.
• What did NOT leak: no payment or financial data was accessed, according to Amadeus and every airline that has reported so far.
• What to do: if you flew with an affected airline between August 2023 and September 2026, watch for phishing messages that quote your real booking details.

Amadeus data breach: what happened

Amadeus IT Group, the Madrid-based company whose reservation and booking technology sits behind more than 100 airlines, has confirmed unauthorised access to one of its booking systems. The airlines' own accounts of the incident say an unauthorised party got into Amadeus reservation records using login credentials assigned to a system account; Amadeus, describing the same incident to the German technology site heise online, said it had learned on 21 September of a potential vulnerability affecting a display environment for travel bookings. The two descriptions have not yet been reconciled in public, and no statement has said whose login it was or how it was obtained.

The timeline matters because of how long it ran. The unauthorised access stretched from August 2023 to September 2026 — roughly three years — before Amadeus contained it in September 2026. Notifications then rolled out airline by airline through October and early November: Korean Air on 20 October, Japan Airlines on 23 October, Cathay Pacific on 30 October, Malaysia Airlines on 31 October, and Qantas on 2 November. Amadeus says it has reset passwords and added enhanced monitoring to its systems.

Amadeus breach affected airlines: the numbers so far

Not every airline has published a count, and the counts that exist measure different things — bookings for one carrier, customers for another — so they cannot simply be added together. Here is what each carrier has confirmed:

Airline	Confirmed exposure	Data involved
Cathay Pacific	~53,000 bookings	Mostly booking reference, name, flight details; smaller subset: email, phone, travel document and frequent-flyer numbers
Japan Airlines (+ Japan Transocean Air)	~92,000 customers	~90,000 basic records (booking ref, name, flight date, route, class); ~2,000 extended records incl. passport numbers, nationality, contact details
Thai Airways	~60,529 booking records (+ 376 possibly affected)	Names, booking refs, travel dates, routes, classes; the 376 possibly-affected records may also include email, phone, passport numbers, nationality and frequent-flyer numbers
ANA	~37,800 customers	~36,100 basic records; ~1,700 extended records incl. passport numbers and contact details
Qantas	Confirmed; no count disclosed	Qantas bookings under review; Qantas' own systems unaffected; reported to Australia's cyber authorities
Malaysia Airlines	Confirmed; no count disclosed	Customer records involved; no financial data accessed
Korean Air, Asiana, Singapore Airlines, Condor	Named as affected / investigating	Details still being assessed with Amadeus

Two reassurances are consistent across every statement: no airline has reported payment or financial information being accessed, and Amadeus says it has found no evidence that the affected data has been misused. That second point is worth reading carefully — "no evidence of misuse" is not the same as a guarantee, and the data involved is exactly the kind that powers convincing phishing.

Illustrative image: an airplane in flight. Several of the affected carriers — Singapore Airlines, Malaysia Airlines, Cathay Pacific, Japan Airlines, ANA and Korean Air — operate services used by Indian travellers. Image: Wikimedia Commons.

Why it matters for India flyers

This is a supply-chain breach, and that is the lesson. None of the affected airlines had their own systems compromised — the exposure came through a shared vendor that sits underneath them all. It is the same pattern as the week's other big stories: our NSW Health cyber breach explainer and the Node-RED exploited flaw explainer both turned on a trusted third party becoming the way in.

For India readers, the exposure window is the practical check. If you booked with Cathay Pacific, Japan Airlines, ANA, Singapore Airlines, Malaysia Airlines, Korean Air, Asiana or Qantas between August 2023 and September 2026, your booking record may be among those accessed. Airlines are contacting affected passengers directly and, in some cases, issuing new booking reference numbers. The real risk now is phishing: a message that already knows your name, route and travel date looks far more legitimate than a generic scam — and booking references can also be used to change or cancel a booking. Treat any unexpected message about an old booking as suspect, verify through the airline's official app or site, and never share a booking reference or passport scan in reply to an unsolicited message.

Should you care?

✅ Yes, if you flew with an affected airline in the last three years — ⏳ but don't panic. No money data leaked and no misuse has been found, so this is a "stay alert" breach, not a "freeze everything" one. Check the airline's notice, expect possible phishing using your real trip details, and ask for a new booking reference if yours was exposed.

FAQs

Which airlines are affected by the Amadeus data breach?
Cathay Pacific, Japan Airlines, ANA, Thai Airways (~60,529 booking records), Qantas and Malaysia Airlines have confirmed exposure, and Korean Air, Asiana, Singapore Airlines and Condor are also named as affected or investigating. Amadeus technology serves more than 100 airlines, so more carriers could still confirm — check your airline's own notice rather than assuming you are clear.

Was my payment or credit card data leaked in the Amadeus breach?
No, according to Amadeus and every airline that has reported. The accessed data was passenger reservation information — names, booking references, flight details and, for a smaller group, contact and travel-document details. No financial or payment information was accessed.

What should I do if I flew with an affected airline?
First, check whether your airline has contacted you or published a notice. Watch for phishing emails, calls or messages that quote your real booking details, and verify anything suspicious through the airline's official app or website. If your booking reference was exposed, ask the airline for a new one.

How long did the Amadeus breach last?
The unauthorised access ran from August 2023 to September 2026 — about three years — before Amadeus contained it in September 2026. Airlines were notified through October and early November 2026, which is why the story is breaking now even though the access ended weeks ago.

Takeaway: A single travel-tech vendor quietly held three years of passenger records, and one misused login exposed them across a dozen airlines. No money data leaked — but your old booking details are now useful to scammers, so treat messages about past trips with suspicion.

Follow World Tech on TechByCountry for tomorrow's 6 PM update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• Khaosod English — Thai Airways says 60,529 passenger booking records exposed in Amadeus breach (10 Nov 2026)
• Onmanorama — Global airline bookings affected by 'Amadeus breach' incident: What flyers should do (4 Nov 2026)
• BeInSure — Qantas and major Asian airlines affected by Amadeus data breach
• Insurance Business — Vendor cyber risk in focus as Amadeus breach hits airlines globally
• Australian Aviation — Qantas customer data possibly exposed in Amadeus hack (2 Nov 2026)
• Nile1 — Amadeus Data Breach: Airlines Describe a Misused Login, Amadeus a Display Flaw