A security incident at travel technology giant Amadeus has exposed more than 180,000 airline passenger and booking records across Asia, as Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air, Asiana Airlines and Star Flyer have each confirmed that customer data held in Amadeus systems was accessed without authorization. The unauthorized access ran for more than 3 years, from August 2023 until September 2026.
Amadeus operates the passenger service and reservation systems used by more than 400 airlines worldwide. The company has not disclosed how many airlines or passengers were affected in total.
One Account Credential and a 3-Year Window
According to the airlines’ notices, an unauthorized party used login credentials assigned to an Amadeus system account to view booking data. Korean Air and Asiana Airlines said Amadeus notified them on October 20, and both stressed that their own systems were not breached. Cathay Pacific said the intruder used credentials assigned to its system account, and that Amadeus has since reset the password and added monitoring.
Amadeus previously said it became aware on September 21 of a potential vulnerability affecting a travel booking display environment, that no payment data was involved, and that there was no indication of ransomware. The company said it fixed the issue and enhanced monitoring. According to reports in German media, security researchers had earlier found an unauthenticated Spring Boot heap dump endpoint that exposed credentials and tokens, though Amadeus has not publicly linked that finding to the airline incident.
Airline by Airline: Who Has Disclosed So Far
- Japan Airlines and Japan Transocean Air: about 92,000 customers. JAL said in its official notice that Amadeus informed it on October 23 and that access occurred between August 10, 2023 and September 23, 2026.
- All Nippon Airways: about 37,800 customers, according to ANA’s official notice. ANA said the relevant credentials were invalidated and monitoring was strengthened.
- Cathay Pacific: about 53,000 bookings made between August 2023 and September 2026, according to the airline’s data security notice. Cathay said it was notified on October 28 and has informed the relevant authorities.
- Star Flyer: bookings made through ANA between July 28, 2025 and September 23, 2026, per its notice. The number of affected customers is still being verified.
- Korean Air and Asiana Airlines: both confirmed exposure through the Amadeus account. Asiana said no payment information was involved. Neither airline has published a final count.
Passport Numbers Exposed for a Smaller Group
For most affected travelers, the exposed records contain basic booking details. JAL said roughly 90,000 of its customers had their booking reference, name, flight date, route and class of travel exposed. For about 2,000 more JAL customers, the data also included email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers, and flight, ticket and seat numbers. ANA reported a similar split, with about 36,100 customers exposed at the basic level and about 1,700 with extended details.
The airlines said no credit card numbers or passwords were exposed, that they have found no evidence of misuse, and that flight operations were not affected.
Why One Vendor Credential Hits So Many Airlines
Global distribution and passenger service systems sit at the center of airline operations, and a single credential with broad read access can reach records from many carriers at once. The airlines’ disclosures so far come largely from Asia, but Amadeus serves hundreds of carriers worldwide, so further notices from other airlines would not be surprising.
Travel platforms remain a frequent target. BreachNews has previously reported on Booking.com’s confirmed breach of guest reservation data and the ShinyHunters claim against BCD Travel.
What Affected Travelers Should Do
- Treat unexpected emails, calls or texts that reference a past or upcoming flight with caution, even if they quote a real booking reference.
- Never share passport details, payment information or frequent flyer logins in response to unsolicited contact.
- Check frequent flyer accounts for unfamiliar activity and enable multi-factor authentication where available.
Amadeus had not issued a public statement on the total number of affected airlines or passengers at time of publication.
