Amadeus, the Spanish company that provides critical infrastructure to many airlines, was hacked for an extended period between August 10, 2023, and September 23, 2026.
Malaysia Airlines, Cathay Pacific, and Japan Airlines have informed affected passengers, and the hack also affects other airlines, including Korean Air, Asiana, and ANA.
Amadeus has informed affected airlines, yet they (Amadeus) have not issued any press releases about the hack (likely they prefer that their brand is not associated with this cybersecurity issue).
Airlines are required by law in many countries to inform passengers whose information has been leaked, and many have received emails from airlines over the past 24 hours.
Malaysia Airlines Announcement:
Cybersecurity Incident Involving Third-Party Technology Provider
30 Oct 2026|Important For You
Malaysia Airlines wishes to inform customers of a cybersecurity incident involving Amadeus, our third-party airline reservation technology provider.
The incident may have affected certain customer information processed through Amadeus between August 2023 and September 2026. We wish to reassure customers that Malaysia Airlines’ own IT systems have not been compromised, and there is currently no evidence that financial information has been accessed.
We are treating this matter with the utmost seriousness and are working closely with Amadeus and relevant parties to investigate the incident and assess its impact.
As a precaution, we encourage customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information.
The privacy and protection of our customers’ information remain our foremost priority. We are committed to ensuring that this matter receives the highest level of attention and appropriate safeguards.
We will provide further updates as more information becomes available.
Cathay Pacific’s Announcement:
Personal data security incident involving a third-party service provider
(30 October 2026)
Latest update: 30 Oct 2026 16:11 HKT (GMT+8)
Cathay Pacific has been made aware of a data security incident involving personal data processed by a third-party service provider.
Cathay Pacific was notified by Amadeus IT Group, S.A. (Amadeus), a global travel technology company that provides technology solutions to the travel industry, including hundreds of airlines worldwide, and a service provider for Cathay Pacific, on 28 October 2026, and received further details from Amadeus on 29 October 2026, regarding unauthorised access to travel reservation data in its systems by an unauthorised party using login credentials assigned to its system account. This included reservation records relating to Cathay Pacific.
According to data provided by Amadeus, around 53,000 bookings relating to Cathay Pacific were affected by the unauthorised access in Amadeus’s system, which occurred between August 2023 and September 2026. In the majority of cases, the information accessed included booking reference, passenger name, and flight details. In a smaller subset of cases, additional personal information including but not limited to email and phone contacts, travel document and/ or frequent flyer number were potentially accessed. However, there is no evidence that financial or payment information was accessed.
Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus has not identified evidence that the affected data has been misused.
The incident has not impacted and is not impacting Cathay Pacific’s systems or operations.
Cathay Pacific takes the protection of personal data extremely seriously and had informed the relevant authorities of the incident.
We are continuing to investigate the incident, including analysing the data and information provided by Amadeus, and will notify affected customers individually once we have established the relevant details.
We apologise to our customers for the concern and inconvenience caused by this incident.
Japan Airlines Announcement:
Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response
Thank you for your continued support of the JAL Group.
On October 23, 2026, Japan Airlines and Japan Transocean Air were informed by Amadeus IT Group, S.A. (“Amadeus”), the provider of our Passenger Service System (PSS) that integrates flight reservations, ticketing, and check-in procedures, that traces were found indicating a portion of customer reservation data had been accessed externally due to unauthorized access to its system.
Furthermore, there has been no compromise of credit card numbers or any passwords.
Amadeus has already completed the necessary security measures, and there is currently no evidence to suggest that any customer information has been misused.
In addition, this incident has no impact on our flight operations.
We sincerely apologize for any concern and inconvenience this situation may cause to our customers and all parties involved.
Scope of Impact
Period (Period during which traces of external access were identified)
August 10, 2023 – September 23, 2026
Reservation Records
A portion of reservation records for Japan Airlines and Japan Transocean Air flights
Number of Affected Individuals and Items with Traces of Access
– Approx. 90,000 customers: Reservation code (PNR) / Name / Flight date / Flight sector / Class of service
– Approx. 2,000 customers: In addition to the above, Email address / Phone number / Passport number / Nationality / Frequent flyer number / Airline name / Flight number / Ticket number / Seat number, etc.
– Total: Approx. 92,000 customers
Future Actions
We have contacted the affected customers regarding this matter via the email addresses provided at the time of booking. We kindly ask you to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group. In addition, inquiries regarding this matter are being handled at the dedicated inquiry desk below.
Dedicated Inquiry Desk for This Matter
TEL: From within Japan: 0120-25-6050 / 03-4332-7280
From overseas: +81-3-4332-7280
Operating Hours: 10:00 – 17:00 (JST), Monday through Friday (Excluding weekends and Japanese national holidays)
Conclusion
Apparently, someone had valid login credentials to Amadeus systems and used them to vacuum this information, based on reports shared.
Amadeus has not, however, confirmed to outside parties what happened, when, and how.
This is a nightmare scenario for Amadeus, as they have been leaking passenger data for more than three years, and have not been able to catch this action earlier.
It is unclear how this information has been used or could have been used, but a PNR and a passenger’s last name are pretty much the only things you need to modify a booking, such as changing the frequent flier number or canceling it altogether.