Cybersecurity News | November 4, 2026

A cybersecurity incident involving travel-technology provider Amadeus has exposed airline reservation information belonging to customers of several major carriers, raising fresh concerns about the security of the global aviation industry’s technology supply chain. Singapore Airlines confirmed that approximately 46,000 booking records were accessed, while other airlines, including Japan Airlines, Cathay Pacific and All Nippon Airways, have reported separate impacts involving their customers’ reservation information.

The exposed information includes passenger names, booking references, travel dates, flight itineraries and other reservation details. In some cases, additional personal information such as email addresses, telephone numbers, passport details and frequent-flyer membership numbers may also have been accessed.

Airlines have said that their own systems and flight operations were not affected. Amadeus has stated that it addressed a vulnerability in a travel-booking display environment and introduced additional security measures. However, investigations remain ongoing, and the company has not publicly provided a complete technical explanation of the incident.

The Amadeus data breach highlights the risks that can arise when airlines rely on external technology providers to manage sensitive passenger information. It also demonstrates why cybersecurity responsibilities must extend beyond an organisation’s own networks and systems.

What Happened in the Amadeus Data Breach?

Amadeus is a Spain-based travel technology company that provides software and services to airlines and other organisations across the travel industry. Its systems support functions such as reservations, passenger services, booking management and other travel-related operations.

Airlines use technology providers like Amadeus to manage complex processes that connect passengers, travel agencies, airports and airline operations. These platforms can handle large volumes of information, including passenger identities, travel schedules, booking references and loyalty-programme details.

In October 2026, Amadeus published a statement confirming that it had become aware of a vulnerability affecting a travel-booking display environment. The company said certain booking-display data had been accessible through the vulnerability.

Amadeus also stated that its investigation had found no evidence that payment or financial information had been accessed. It said there were no indications that the vulnerability had been exploited for ransomware purposes.

The company reported implementing measures to fix the vulnerability and strengthening its monitoring and detection capabilities. It also said it was communicating directly with customers and relevant authorities.

Several airlines subsequently disclosed that unauthorised access to reservation information held within Amadeus systems had affected their customers. Their individual announcements revealed that the incident had a wider impact than the initial disclosures suggested.

Although the airlines have provided information about the records potentially accessed, Amadeus has not publicly disclosed a complete list of affected customers or a consolidated figure covering all airlines.

Singapore Airlines Confirms 46,000 Booking Records Accessed

Singapore Airlines confirmed on November 3 that information relating to approximately 46,000 booking records had been accessed through Amadeus.

According to the airline, the information included:

• Customer names.
• Booking reference numbers.
• Travel itineraries.
• Booking classes.

For approximately 620 booking records, additional information may also have been accessed. This included email addresses, telephone numbers, travel-document details and KrisFlyer membership numbers.

The airline said the incident involved unauthorized third-party access to customer information stored on Amadeus’ platform. It emphasised that its own information technology systems had not been breached.

Singapore Airlines also said Amadeus had implemented containment measures and additional security safeguards following the incident.

According to the airline, Amadeus confirmed that bank account and credit card information had not been exposed. The unauthorised access also did not result in changes to flight bookings.

As a precaution, Singapore Airlines said it was contacting affected customers with upcoming travel plans to change their booking reference numbers. The carrier also confirmed that it had informed the relevant authorities and apologised to affected passengers.

The disclosure makes the Amadeus data breach particularly significant for travellers because booking references and itinerary details can provide information that criminals could potentially use to make fraudulent communications appear legitimate.

Other Major Airlines Report Customer Data Exposure

Singapore Airlines is not the only carrier to report an impact. Several airlines in Asia have disclosed that customer reservation information was accessed through systems provided by Amadeus.

The figures released by individual carriers demonstrate the scale of the incident, although they cannot be combined into a reliable worldwide total because airlines report different types of records and affected populations.

Japan Airlines: Approximately 92,000 Customers

Japan Airlines and its group airline Japan Transocean Air reported that approximately 92,000 customers were affected.

The information potentially accessed for most customers included names, reservation codes, flight dates, routes and service classes.

For approximately 2,000 customers, additional information may have been included, such as email addresses, telephone numbers, passport numbers, nationalities and frequent-flyer membership numbers.

Japan Airlines said credit card numbers and passwords were not compromised. It also reported that there was no evidence at the time that customer information had been misused.

All Nippon Airways: Approximately 37,800 Customers

All Nippon Airways (ANA) disclosed that approximately 37,800 customers who made reservations between August 10, 2023, and September 23, 2026, could have been affected.

The airline said approximately 36,100 customers had reservation information potentially accessed, including names, booking references, travel dates, flight routes and cabin classes.

For approximately 1,700 customers, additional information may have been exposed. This included email addresses, telephone numbers, passport numbers, nationalities, frequent-flyer numbers, flight numbers, ticket numbers and seat information.

ANA stated that credit card information and account passwords were not included. It also said the authentication credentials involved had been revoked and that monitoring procedures had been strengthened.

Cathay Pacific: Approximately 53,000 Bookings

Hong Kong-based Cathay Pacific reported that approximately 53,000 bookings were affected.

The airline said the unauthorized access occurred between August 2023 and September 2026. In most cases, the information included booking references, passenger names and flight details.

A smaller number of records may also have contained email addresses, telephone numbers, travel-document information and frequent-flyer details.

Cathay Pacific said it had been informed by Amadeus on October 28 and received additional information the following day. The airline also stated that the incident did not affect its own systems or operations.

It reported that Amadeus had taken containment measures, including a password reset, and had introduced enhanced monitoring and detection capabilities.

Malaysia Airlines and Other Carriers

Malaysia Airlines confirmed that certain customer information processed through Amadeus between August 2023 and September 2026 may have been affected. The carrier did not publish a confirmed number of affected customers in its initial statement.

The airline said its own IT systems had not been compromised and that there was no evidence at the time that financial information had been accessed. It advised customers to remain alert to suspicious communications.

South Korea’s Asiana Airlines and Korean Air have also reported reservation-related information exposure associated with the incident.

Meanwhile, Australia’s Qantas said it was working with Amadeus to understand whether any of its bookings had been affected. The airline said its own systems and databases remained secure.

These disclosures show why the Amadeus data breach should be examined as a wider aviation supply-chain incident rather than as an isolated problem affecting one airline.

What Information Was Potentially Exposed?

The information identified by airlines varies, but the disclosures point to two broad categories of passenger data.

The first includes standard reservation information, such as passenger names, booking references, flight dates, routes and travel classes. This information can reveal where and when a person is travelling and may be sufficient to make a fraudulent message appear connected to a genuine booking.

The second category includes additional personal details. Depending on the airline and the affected record, this may include email addresses, telephone numbers, passport information, nationality and frequent-flyer membership numbers.

The distinction matters because not every affected passenger appears to have had the same information exposed. Some disclosures identify additional information in only a smaller subset of records.

Airlines have also made clear that payment information was not identified among the exposed data in their reported cases. Singapore Airlines said Amadeus confirmed that bank account and credit card information had not been accessed. ANA similarly said credit card information and account passwords were not included.

These statements are important, but they do not mean that the incident carries no risk. Personal and travel information can still be valuable to criminals, particularly when several details are combined.

How Could Exposed Booking Information Be Abused?

Passenger reservation information can make targeted social engineering more convincing.

For example, a criminal who knows a passenger’s name, destination, flight date and booking reference could attempt to send a message pretending to be an airline representative. The message might claim that a flight has changed, that a payment needs to be confirmed or that additional travel documentation is required.

A message containing genuine itinerary details may appear more credible than a generic phishing attempt. Recipients could be more likely to trust a communication that refers to a real flight or booking.

Exposed contact details could also support targeted phishing through email, text messages or telephone calls. If travel-document information is included, criminals may use it to make fraudulent requests appear more official.

Frequent-flyer information could create additional risks if attackers attempt to impersonate an airline’s loyalty programme or persuade customers to disclose login credentials.

However, these are potential abuse scenarios, not confirmed outcomes of this incident. The airlines’ public statements do not establish that exposed records have been used for fraud, account takeovers or other criminal activity.

Customers should therefore take reasonable precautions without assuming that their bookings or financial accounts have already been compromised.

Why the Incident Raises Supply-Chain Security Concerns

The Amadeus data breach illustrates a major challenge for modern cybersecurity: organisations depend on technology providers to perform essential business functions, but those providers may also hold sensitive information belonging to millions of customers.

Airlines operate interconnected digital environments. Reservation platforms communicate with airline systems, travel agencies, payment services, airport operations and other providers. These relationships make the travel industry more efficient, but they also create dependencies that must be secured.

A security weakness in a third-party platform can expose information belonging to multiple organisations, even when the affected organisations’ internal networks remain secure.

This is why protecting an organisation’s own infrastructure is not enough. Security programmes must also consider how external providers store, access, process and protect customer information.

Businesses should understand which vendors have access to sensitive records, what permissions those vendors receive and how access is monitored. They should also establish clear requirements for incident notification, vulnerability management, credential protection and independent security assessments.

The disclosures also raise questions about how long reservation information needs to remain accessible and whether access permissions are reviewed regularly. Where historical booking records remain available, organisations should ensure that retention periods and access controls are appropriate for the information involved.

For aviation companies, these measures are particularly important because passenger information can include travel patterns and identity details that customers reasonably expect to remain private.

What Airlines and Technology Providers Are Doing

Amadeus has stated that it implemented measures to fix the vulnerability and strengthened monitoring and detection capabilities. Its public statement also says the company is communicating with customers and authorities.

Individual airlines have announced additional steps.

Singapore Airlines is contacting affected customers with upcoming travel plans to change their booking references. Cathay Pacific said Amadeus had taken containment measures, including a password reset, and introduced enhanced monitoring. ANA said the relevant authentication credentials had been revoked and monitoring protocols strengthened.

Other carriers have also said they are assessing the impact, reviewing information supplied by Amadeus and notifying affected customers.

These actions address different parts of the response: limiting further access, protecting affected bookings, reviewing the information involved and helping customers recognise possible fraud attempts.

Nevertheless, the public information remains incomplete. The full scope of the incident, the total number of affected airlines and the exact technical circumstances have not been established in a comprehensive public account.

What Passengers Should Do Now

Travellers who have booked with an affected airline should monitor official communications and follow any instructions provided directly by the carrier.

Customers should also take several precautions:

• Verify messages independently: Do not rely on links or telephone numbers contained in unexpected emails, text messages or social-media advertisements. Visit the airline’s official website or app directly.
• Be alert to booking-related phishing: Treat unexpected requests involving rebooking, refunds, travel documents or payment verification with caution.
• Protect frequent-flyer accounts: Use a unique password and enable additional authentication where available.
• Review upcoming bookings: Check reservations through official airline channels and report any unexpected changes.
• Avoid sharing sensitive details: Do not send passport information, passwords or payment details in response to unsolicited communications.
• Contact the airline directly: If an airline confirms that your information may have been affected, use its official customer-service channels for guidance.

Passengers who receive a breach notification should read it carefully to understand which categories of information may have been involved. The appropriate response may differ depending on whether the exposed information includes only booking details or additional personal and travel-document information.

What Investigators Still Need to Establish

Several important questions remain unanswered.

First, Amadeus has not publicly provided a detailed technical explanation of the vulnerability, including the precise weakness, how it was discovered or the full sequence of events that allowed booking information to become accessible.

Second, the total number of affected airlines and passengers remains unknown. The figures released so far represent individual airline disclosures, and they use different measures, including booking records, bookings and customers.

Third, the identity of the unauthorised party has not been publicly established. The available disclosures do not provide a verified attribution to a specific criminal group or state-sponsored actor.

Finally, the extent of any misuse remains unclear. Some airlines have reported no evidence of misuse at the time of their announcements, but investigations and assessments are continuing.

The Amadeus data breach is a reminder that customer information can be exposed through systems outside the direct control of the organisation that collected it. As the investigation develops, further disclosures may clarify the technical cause, the number of affected customers and whether additional airlines were involved.

For now, the incident reinforces the need for stronger third-party security controls, transparent incident reporting and practical protection for passengers whose personal information is handled across the global aviation technology ecosystem.

Source note: This report draws on statements from Amadeus, Singapore Airlines, Cathay Pacific, All Nippon Airways and Malaysia Airlines, alongside reporting by Reuters, Channel NewsAsia and other established news organisations. Airline-specific figures are presented separately because they refer to different types of records and affected populations. The technical cause, total global impact and identity of the unauthorised party have not been fully established publicly.

NewsFlayer — Your trusted source for cybersecurity news, digital threats and technology developments.