Menu
Breach value calculatorCalculator

Amadeus Data Breach 2026: What Airline Passengers Should Do Now

Unauthorised access to Amadeus's airline booking system ran from Aug 2023 to Sep 2026. What was exposed, who confirmed it, and what to do now.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: 10 August 2023Published 11 min read

What is the Amadeus data breach? Amadeus, a supplier whose system airlines use for reservations, ticketing and check-in, says "certain booking-display data was accessible" through a vulnerability. Japan Airlines (JAL) says data was accessed from outside between 10 August 2023 and 23 September 2026, affecting about 92,000 JAL and Japan Transocean Air (JTA) customers.

JAL says no card numbers or passwords were taken. The likeliest risk now is convincing phishing; JAL and Malaysia Airlines both warn their customers to watch for suspicious messages.

Amadeus told JAL about it on 23 October 2026. Malaysia Airlines has also confirmed it was affected.

Below is what each organisation says in its own words, what has only been reported, and what to do if you have flown with an affected airline. More case files from the region are in Breaches: Asia.

Case file

Field Value
Organisation Amadeus (airline technology supplier). Airlines confirmed at source: Japan Airlines (JAL), Japan Transocean Air (JTA), Malaysia Airlines
Region Japan and Malaysia, for the airlines confirmed so far
Breach date Traces of external access from 10 August 2023 to 23 September 2026 (JAL). Malaysia Airlines gives August 2023 to September 2026 (Malaysia Airlines)
Disclosed Amadeus informed JAL and JTA on 23 October 2026. JAL's notice is dated 30 October 2026. Amadeus's statement is dated October 2026, with no day (Amadeus)
People affected About 92,000 JAL and JTA customers. No total across all airlines has been published
Data types Booking code, name, flight date, sector and class for all 92,000; for about 2,000 of them, also email, phone, passport number, nationality, frequent-flyer number, ticket and seat number (JAL)
Not taken Card numbers and passwords (JAL). Amadeus says there is "no evidence that payment or financial data was accessed"
Penalty/action None announced
Regulator None named. Amadeus says it is "in direct dialogue with our customers and authorities" without naming them. No regulator filing had turned up in our searches by 1 November 2026
Status Amadeus says it "implemented measures to fix the vulnerability" and added monitoring. Its investigation continues

What happened in the Amadeus data breach?

A Passenger Service System (PSS) is the software an airline uses to take reservations, issue tickets and check passengers in. Many airlines rent theirs from a supplier instead of building their own. JAL's notice says the access happened through Amadeus's PSS, not through JAL's own systems (JAL).

Amadeus's own statement is short. It says the company "became aware of a vulnerability affecting a travel booking display environment" and that "certain booking-display data was accessible through the vulnerability" (Amadeus). It adds:

  • "there is no evidence that payment or financial data was accessed";
  • "There are no indications that this vulnerability has been exploited for ransomware purposes";
  • it "implemented measures to fix the vulnerability" and put in "enhanced monitoring and detection capabilities";
  • "our investigations continue".

The statement names no airline and gives no dates or counts. JAL's notice names Amadeus directly, so the link between JAL and Amadeus is confirmed. Amadeus does not say its statement covers the same event; the match rests on its timing and wording.

JAL's notice, dated 30 October 2026 and issued with its regional airline Japan Transocean Air (JTA), gives the detail Amadeus doesn't. Amadeus told both airlines on 23 October 2026 that traces showed part of their customer reservation data had been accessed from outside. JAL says Amadeus has completed its security measures, there is no evidence of misuse so far, flights are not affected, and affected customers have been emailed.

Which airlines have confirmed they were affected?

Three airlines have said so on their own pages, and one more has been reported.

  • Japan Airlines and Japan Transocean Air, in the joint notice of 30 October 2026 described above.
  • Malaysia Airlines, in an undated statement. It says "certain customer information processed through Amadeus" between August 2023 and September 2026 may be affected. Its own IT systems were not compromised, and there is no evidence so far that financial information was accessed. It is investigating with Amadeus and other parties and asks customers to be wary of unexpected messages that ask for personal or financial details (Malaysia Airlines).
  • Korean Air, as reported by MoneyToday on 23 October 2026. According to that report, Korean Air said Amadeus notified it at "10:44 p.m. on October 20" 2026 and that reservation numbers were exposed. Korean Air's newsroom had no statement on it between 20 October and 1 November 2026, so treat this as reported, not confirmed.

How many airlines use the affected environment, and how many passengers there are in total, is not public. Amadeus has not said.

What passenger data was exposed?

JAL's notice splits its customers into two groups (JAL):

Group About how many Data JAL lists
Booking details only 90,000 Booking code (PNR), name, flight date, sector, class of service
Booking details plus contact and travel documents 2,000 All of the above, plus email, phone number, passport number, nationality, frequent-flyer number, ticket number, seat number and other items
Total 92,000 No card numbers or passwords

A PNR, or passenger name record, is the reference code that ties a booking together. On its own it is not a password. But with your name, date and route, it is enough to write a message about your real trip that sounds like it came from the airline.

Malaysia Airlines has not published a count or a list of data fields.

What should travellers do after the Amadeus breach?

The likely harm here is not someone flying on your ticket. It is a scam that knows your booking. For the 2,000 JAL customers whose passport details were included, it is also someone presenting those details as proof they are genuine.

  1. Check airline emails before you act on them. A message that quotes your correct booking code and flight date can still be fake. Open the airline's app, or type its web address yourself, and look up the booking there.
  2. Don't click links or open attachments in unexpected travel messages. That includes texts and chat messages, not only email.
  3. Be most careful with "rebooking", "schedule change", "refund" or "compensation" messages, above all ones that ask for card details or a payment. JAL says no card numbers were taken, so a request to "re-confirm" your card is a warning sign, not a fix.
  4. Change your frequent-flyer password and turn on two-step login if the programme offers it. JAL says passwords were not taken. The point is that your frequent-flyer number may now be in a scammer's hands, and the account behind it holds miles and personal details.
  5. If your passport details were involved, watch for anyone using them. Knowing your passport number does not prove a caller or sender works for the airline. If you see signs of misuse, report it to the authority that issued your passport.
  6. When in doubt, call the airline on the number shown on its official website, not one given in a message.

If you run travel for a company, tell your travellers this week. The controls that stop a convincing email becoming a payment or a stolen login are in our AI phishing protection plan.

What has been confirmed about the Amadeus incident, and what is still missing?

As of 1 November 2026:

Question Confirmed, and by whom Not public yet
When Traces of access from 10 August 2023 to 23 September 2026 (JAL) When Amadeus discovered it. Korean Air was reportedly told on 20 October 2026
How "A vulnerability affecting a travel booking display environment" (Amadeus) The root cause. Korean Air is reported to cite misused account login credentials; Amadeus has not said so
Which airlines JAL, JTA and Malaysia Airlines The full list. Korean Air is reported only
How many people About 92,000 JAL and JTA customers Malaysia Airlines' count, and any total across airlines
Payment data No card numbers or passwords (JAL); no evidence of payment or financial data access (Amadeus, Malaysia Airlines) Whether the investigation changes that
Misuse No evidence so far (JAL) Whether any data has been offered for sale
Regulators Amadeus is in dialogue with unnamed "authorities" Any regulator filing, investigation or penalty
Fix "Implemented measures to fix the vulnerability", monitoring added (Amadeus); security measures completed (JAL) Any independent confirmation

Going deeper: for security and IT teams

The sources above describe outcomes, not mechanics. Amadeus has not described its architecture or the failure point, so treat what follows as general guidance, not a reconstruction. It is what the published facts imply for any organisation that relies on a shared industry platform.

Threat model. A shared PSS keeps many airlines' passenger records in one supplier's environment. An attacker who finds one weakness there, whether a software flaw or a working account, can read records belonging to several airlines' customers without touching any airline's own network.

Malaysia Airlines says only that its own IT systems were not compromised. In an incident like this, an attacker would not need to get past the airline's own controls. The prize is identity plus itinerary, which is what targeted phishing needs, and for some passengers passport data.

Two accounts of the cause, unreconciled. Amadeus says "a vulnerability". Korean Air, as reported by MoneyToday, says it was "unauthorized access using login authentication information assigned to an account in Amadeus's system". If the second is right, the technique is MITRE ATT&CK T1078 Valid Accounts.

Its mitigations apply on both sides of the contract: the supplier's staff and service accounts, and the agent accounts your own people hold on the supplier's platform. M1032 asks for MFA "across all account types". M1018 says: "Regularly audit user accounts for activity and deactivate or remove any that are no longer needed." M1026 asks for routine audits of privileged accounts. Detection strategy DET0560 includes analytics for logins at unusual times (AN1545) and identity-provider anomalies such as impossible travel (AN1546).

In practice: the airline industry has been here before. SITA, another airline IT provider, says it "became a victim of a highly sophisticated cyber-attack in early 2021, leading to a data security incident involving certain passenger data stored on SITA Passenger Service System servers" (SITA, Chair's Statement 2021). SITA gives no exact month.

The response it describes is a governance one: an independent review, a board Cyber Security Committee, a Special General Assembly for members on 22 February 2022, and a security improvement programme of "38 actions across 24 projects". A supplier incident on a shared platform becomes every customer's incident, so expect to need answers from the supplier for months.

An access window of more than three years. By JAL's dates, the access window is about 1,140 days. A window of traces is not proof of continuous presence, but it sets the scale.

Mandiant's M-Trends 2026, published 24 March 2026, puts the global median dwell time at 14 days, up from 11. It also reports dwell times of "nearly 400 days" for BRICKSTORM and warns that "standard 90-day log retention policies leave organizations completely blind to the initial access vector". The Amadeus window is nearly three times as long as that BRICKSTORM figure.

We define dwell time and its clocks in our data breach lifecycle guide; the point here is narrower. On a supplier's platform, the logs that cover your data are usually the supplier's, so their retention is your investigation limit.

Detection when the harm is reading, not changing. Booking-display access leaves no broken system behind. Signals worth asking your supplier to alert on, or to export to you:

  • read volume per account against its own baseline, especially bulk lookups of records the account never changes;
  • lookups of bookings outside the account's usual office, market or hours;
  • the same account active from new networks or countries;
  • canary records: fake bookings in your own data that no real user should open, with an alert on any read. This is a general technique, not a documented Amadeus control.

What to ask your own providers. Our third-party risk management guide covers tiering, clauses and exit. For a shared platform, add these:

  • Which of our records sit in an environment other customers also use, and how is our data separated?
  • Do you log every read of our records, not only changes? How long do you keep those logs, and can we get our share?
  • Is MFA enforced for every human and service account that can display our data, including your own support staff?
  • If a flaw or account is abused, can you tell us exactly which of our records were read, and by when?
  • How soon after you confirm an incident will you notify us, and through which channel?

Key takeaways

  • Amadeus says a vulnerability in a "travel booking display environment" made some booking data accessible, with no evidence payment or financial data was accessed. Its statement is dated October 2026 with no day.
  • JAL and JTA say Amadeus told them on 23 October 2026, with traces of access from 10 August 2023 to 23 September 2026, affecting about 92,000 customers.
  • About 2,000 of those also had passport number, nationality, email, phone and frequent-flyer number exposed. No card numbers or passwords were taken.
  • Malaysia Airlines has confirmed it was affected. Korean Air's involvement is reported, not confirmed at source.
  • Not yet public: the total number of airlines and passengers, the root cause, and any regulator filing.
  • For travellers: verify every airline message in the airline's own app, ignore unexpected refund or rebooking links, and secure your frequent-flyer account.
  • For security teams: on a shared platform, the supplier's read logs and their retention decide what you can ever find out.

Sources

All read on 1 November 2026.

Spotted a mistake? Report a correction.