Security incident at Amadeus: seven airlines warn passengers
Unauthorised access to reservation data has encompassed information on passengers of several Asian carriers. The extent of the exposed data varies among the companies, and some records also include passport numbers.
Seven airlines have informed passengers of a security incident related to Amadeus's systems. The notices were issued by Cathay Pacific, Japan Airlines, Japan Transocean Air, All Nippon Airways, Star Flyer, Korean Air and Asiana Airlines.
In its October 2026 statement, Amadeus confirmed a vulnerability in its reservation display environment, which allowed certain reservation data to be accessed by unauthorised individuals. The company states that it has implemented measures to eliminate the vulnerability and has stepped up monitoring. The investigation is ongoing, and so far there is no evidence of access to financial or payment data.
For travellers, the main reason for caution is the possibility of misuse of actual travel details in fake messages that appear to be official communication from an airline or travel agency.
Thousands of passengers and bookings, but varying degrees of exposure.
Japan Airlines and Japan Transocean Air have reported traces of data access for approximately 92,000 passengers. For around 90,000 people, the information included name, booking code, flight date, route and cabin class. For approximately 2,000 passengers, a broader set of information was covered, including contact details, passport number, nationality and card details.
ANA stated that approximately 37,800 passengers were affected. For around 1,700 of them, additional personal data, including passport numbers and contact details, were potentially available.
Cathay Pacific reported approximately 53,000 affected bookings. In most cases, the reservation code, passenger name and flight details were accessed, while a smaller number of records may have included additional personal information. That figure refers to reservations, and it is therefore not justified to sum it with the number of passengers on other carriers as a single total of affected individuals.
Korean Air and Asiana Airlines have confirmed that the exposed data included the booking codes of some passengers, while they are still verifying the other categories. Both airlines state that they have found no signs of intrusion into their own internal databases. Star Flyer also issued a warning, but in its verified notice has not yet provided the final number of affected passengers.
Not all passengers are affected, nor are they all exposed to the same data.
The published notices do not mean that all bookings of the aforementioned airlines or all users of Amadeus services have been compromised.
JAL, ANA and Star Flyer explicitly state that the incident did not involve credit card numbers or user account passwords. Cathay Pacific has found no evidence of access to financial or payment information. JAL and Cathay Pacific also confirm that the incident did not affect their flight operations.
According to the carriers' notices, security measures included revoking compromised access credentials or resetting passwords, and enhanced system monitoring.
What should travellers and agencies do?
A message containing the exact flight date or booking code may seem convincing, but that information alone is not proof that it was sent by the airline. Particular caution is required when asked for an additional payment, to enter card details or to provide personal documents.
Passengers should follow individual carrier notifications and verify any suspicious requests via the official app, the agency's directly accessed official website or a known agency contact.
For travel agencies, it is a practical step to check whether the notifications they have received relate to their clients' bookings and to clearly convey what the carrier has confirmed. The incident itself is not grounds for concluding that the agency's system has been compromised.
If a client receives an unexpected message about a top-up or refund, they should verify it through the existing communication channel before making any payment or sending any additional information.
