Amadeus breach exposes passenger records across global airlines

A cyber incident has exposed passenger travel records across multiple international carriers via a compromise of Amadeus, a centralised travel distribution platform. Intruders gained unauthorised access using valid system credentials rather than breaching individual airline networks. In response, Amadeus revoked affected access tokens, changed administrative passwords, and boosted security monitoring.

Malaysia Airlines noted that internal airline mainframes remained intact, with exposed records covering bookings dating from August 2023 to September 2026. The incident underscores how reliance on a single third‑party platform can create a shared point of failure for the global aviation sector.

The breach has been disclosed by several major carriers. Japan Airlines confirmed access to information for approximately 92,000 customers, with basic itineraries most common but about 2,000 travellers facing exposure of passport numbers, contact channels, and frequent‑flyer profiles. All Nippon Airways reported exposure affecting around 37,800 passenger files, including roughly 1,700 passport references. Cathay Pacific confirmed 53,000 reservation folders were affected.

Other carriers, including Korean Air and Asiana Airlines, are reviewing potential exposures. Investigators found no evidence of compromised banking or payment card details, and no ransomware activity linked to the intrusion. The exposed Passenger Name Record (PNR) codes raise secondary security risks for travellers, with fraudsters potentially using surnames and reservation locators to craft spear‑phishing messages.

Airlines and authorities are emphasising verification of schedule changes via official channels and strengthening third‑party credential monitoring to mitigate ongoing risk.