Amadeus Breach Exposes Airline Customer Records
Unauthorised access to a booking system run by Amadeus IT Group has exposed records tied to several airlines, including Qantas, Cathay Pacific and Japan Airlines.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust companies holding your travel details to keep them secure?
Madrid-based Amadeus IT Group disclosed unauthorised access to one of its booking systems, affecting multiple airlines whose customer records were exposed. The company said the issue was contained in September 2026, though the access ran from August 2023 to September 2026.
Why it matters
Amadeus's airline technology platforms handled more than 2.2 billion passenger boardings in 2025, so a breach in one of its booking systems reaches travellers well beyond any single carrier. None of the affected airlines had their own systems compromised, which points to risk sitting with a shared third-party provider.
Amadeus's airline platforms processed 2.2 billion passenger boardings in 2025, and the breach touched booking data at several carriers. The attacker's method and full scope across all affected airlines have not been disclosed.
The players
Amadeus IT Group
Amadeus IT Group is a Madrid-headquartered technology company whose airline platforms serve a large share of global air travel bookings and check-in systems.
Qantas Airways
Qantas Airways is Australia's largest airline and the flag carrier of Australia, which reported the incident to national cyber authorities.
Cathay Pacific
Cathay Pacific is the flag carrier of Hong Kong, which disclosed the scale of affected bookings at its end.
Japan Airlines
Japan Airlines is one of Japan's two major international carriers, which reported the number of customers whose passport and frequent flyer numbers were compromised.
The details
Amadeus said one of its booking systems was subjected to unauthorised access, and Qantas Airways and at least three other airlines confirmed customer records were exposed. Exposed data mostly included booking references, passenger names and flight details, while Japan Airlines reported that some customers' passport and frequent flyer numbers were also compromised.
Timeline
August 2023: Unauthorised access to the Amadeus system begins.
September 2026: Amadeus contains the unauthorised access.
October 30, 2026: Cathay Pacific discloses approximately 53,000 affected bookings.
The Tech Race
Australia recorded 1,205 notifiable data breaches in calendar year 2025, an 8% increase on the prior year, according to the Office of the Australian Information Commissioner. The Amadeus incident lands in that rising trend, showing how a single third-party platform can expose records across several national carriers at once.
Travellers booked through affected airlines should watch for official notifications and be alert to phishing messages that use their flight details. Anyone whose passport or frequent flyer number was involved should consider monitoring their accounts and reviewing any loyalty programme activity.
The takeaway
Shared booking platforms concentrate risk, so checking how your airline and travel providers store and protect your data is a practical step. Keep an eye on frequent flyer and booking accounts for unfamiliar activity.
Further reading
For more on how third-party providers create shared exposure, see our Cybersecurity coverage.
Source note: This article includes information reported by Insurance Business.
Live Poll
Do you trust companies holding your travel details to keep them secure?
