Cyberattacks in tourism: the example of the Amadeus and Expedia data breach poses a new threat
Security incidents involving Amadeus and Expedia raise the question of how well protected travellers' booking data is when it passes through the network of technology suppliers. Artificial intelligence can further amplify fraud that relies on such data. What should travel agencies verify?
Today, travel bookings rarely remain within a single system. Passenger data pass through airlines, GDSs, hotel platforms, online booking systems, CRM applications and external technology partners. In the process, a security issue at one participant can affect customers of other companies, even though their own networks have not been breached.
Two recent cases illustrate different types of exposure: unauthorised access to reservation data in the Amadeus environment and an attack via an external technology supplier which, according to Expedia Group, enabled access to its systems. These are not proof that AI was used in those incidents. AI is separate, a growing factor that can increase the credibility and scale of subsequent frauds.
What was confirmed in the cases of Amadeus and Expedia?
Booking information
Airlines have reported unauthorised access to reservation data stored in Amadeus's system. Those affected include Cathay Pacific, Singapore Airlines and Japan Airlines.
Confirmed: names, PNR codes and travel details; for a smaller subset of records, additional personal data. There is no evidence of access to payment data in the aforementioned disclosures.
Supplier attack
Expedia has confirmed that attackers gained access to its systems via a compromised data technology provider.
It has not yet been confirmed: the scope of potentially exposed data, the identity of the supplier and the link to other publicly described incidents.
Cathay Pacific announced that approximately 53,000 bookings were affected, and Singapore Airlines around 46,000 booking records. Japan Airlines reported data for approximately 92,000 passengers. In the case of Cathay Pacific, unauthorised access via system credentials, according to the airline's notice, covered the period from August 2023 to September 2026. It should be distinguished between the compromise of a specific reservation environment and the claim that the entire Amadeus GDS is compromised — there is no confirmation for such a broader conclusion.
At Expedia, the threat from a supplier who has already been granted access is particularly significant. If their credentials are compromised or old privileges remain active, an attacker could inherit access to another company. Research related to the Qubole platform provides a useful example of such a pattern, but it has not been publicly confirmed that this case is directly linked to the Expedia incident.
How does compromised access become a problem for the traveller?
The following diagram shows possible chain of risk, and not a reconstructed sequence of any of the listed incidents. The attack does not have to go through all the steps shown.
Note: a schematic scenario of a possible attack. It does not imply that all the actions shown took place in the Amadeus or Expedia incidents.
Even without the credit card number, the combination of name, booking reference and travel date can be valuable to criminals. A message quoting the actual flight number and requesting immediate confirmation of the booking appears far more convincing than a generic spam email. Depending on each carrier's security measures, the PNR and surname can reveal additional booking details or enable certain actions.
Where does artificial intelligence fit into the whole story?
Generative AI can help compose grammatically convincing messages in different languages, tailor scams to a specific journey, imitate voices, and automatically analyse vulnerabilities. In its 2026 threat outlook, ENISA warns that new AI models will increasingly serve as support for malicious operations. This does not mean that AI is the cause of the confirmed incidents at Amadeus and Expedia, but that stolen data could become even more useful for the next stage of an attack.
„Your flight to Frankfurt tomorrow has been changed. Please confirm booking AB12CD and update your payment method to retain your ticket.”
An accurate itinerary and PNR can enhance credibility. Any payment change should be verified through a previously known official channel, not via the link in the message.
Seven concrete checks for travel agencies
The rules on personal data protection also remain relevant. In certain cases, the GDPR requires a breach to be reported to the competent authority, generally no later than 72 hours after becoming aware of it when there is a likely risk to individuals' rights and freedoms. In the event of high risk, it may also be necessary to notify the affected individuals. Specific obligations depend on the circumstances and the agency's role in data processing.
Data security should become a criterion when selecting suppliers.
Travel agencies traditionally compare the prices, content, support and functionalities of GDS, hotel platforms and booking engines. Security issues deserve the same attention: who has access to reservations, how long is the data retained, how are third-party partners' permissions managed and how quickly does the supplier notify you of an incident?
The most practical starting point is not to purchase yet another tool, but to review accounts, access rights, integrations and payment procedures. In an agency that manages sensitive passenger data on a daily basis, a single neglected credential can create a problem far greater than the technical incident itself.
