Amadeus Breach Exposes Records at Multiple Airlines
A third-party booking platform compromise reached customer data at several carriers, with Japan Airlines reporting passport numbers exposed.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust companies holding your travel details to keep them secure?
Amadeus IT Group, headquartered in Madrid, disclosed unauthorised access to one of its airline booking systems, affecting multiple carriers including Qantas. The access ran from August 2023 to September 2026, and Amadeus said it was contained in September 2026. The incident is a disclosed security breach with confirmed impacts, not an announced product or research-stage development.
Why it matters
The breach shows how a single third-party booking platform can expose customer records across several airlines at once, since none of the affected carriers' own systems were reportedly compromised. Amadeus's airline technology handled more than 2.2 billion passenger boardings in 2025, which concentrates risk in one vendor's infrastructure.
Airline-reported impact figures show 53,000 bookings affected at Cathay Pacific and 90,000 customers with basic booking data exposed at Japan Airlines, with 2,000 of those having passport and frequent flyer numbers compromised. Australia's 2025 total of 1,205 notifiable breaches, up 8%, provides the national backdrop, though the source does not establish how the intrusion occurred.
The players
Amadeus IT Group
Madrid-headquartered travel technology company whose airline platforms handled more than 2.2 billion passenger boardings in 2025.
Qantas Airways
Australian flag carrier that confirmed its customer records were exposed and reported the matter to national cyber authorities.
Cathay Pacific
Hong Kong-based carrier that disclosed approximately 53,000 affected bookings.
Japan Airlines
Japanese carrier that reported 90,000 customers with basic booking information exposed and 2,000 with passport and frequent flyer numbers compromised.
The details
Amadeus operates airline technology platforms that carriers use to manage bookings and passenger records. In this incident, unauthorised access reached one of Amadeus's booking systems, which serves multiple airlines, so customer data held in that system was exposed even though each airline's own systems were not compromised. The accessed data mostly included booking references, passenger names and flight details, with more sensitive identifiers such as passport numbers exposed in a smaller subset of cases.
Timeline
August 2023: unauthorised access to the Amadeus system begins.
September 2026: Amadeus says it contained the unauthorised access.
October 30, 2026: Cathay Pacific discloses approximately 53,000 affected bookings.
The Tech Race
Australia recorded 1,205 notifiable data breaches in calendar year 2025, an 8% rise on the prior year, according to national breach-notification data. The Amadeus incident adds a supplier-level exposure to that trend, since one platform's compromise reached several airlines' customer records.
Passengers whose booking references, names and flight details were held in the affected Amadeus system may face follow-on phishing or identity risk, and those whose passport numbers were exposed at Japan Airlines face the most sensitive exposure. Airlines have not announced specific remediation steps for individual travellers in the source material.
The takeaway
Watch for Amadeus or affected airlines to publish a fuller account of how the intrusion was gained, and for further counts from carriers beyond the four named. The Australian Office of the Australian Information Commissioner's breach statistics will show whether the 2025 trend continues into the next reporting cycle.
Further reading
Explore more on Cybersecurity to see how supplier breaches like this one fit into wider data-protection risk.
Source note: This article includes information reported by Insurance Business.
Live Poll
Do you trust companies holding your travel details to keep them secure?
