Qantas and several major Asian airlines, including Japan Airlines, All Nippon Airways (ANA), Cathay Pacific, and Korean Air, have reported being affected by a cybersecurity breach involving Amadeus, a Spain-based travel technology provider. The breach, which involved unauthorized access to one of Amadeus’s systems, potentially exposed passenger reservation records and booking information.
Amadeus stated that the incident was contained in September 2026 and that there is no evidence of access to payment or financial information. Qantas has confirmed that its internal systems remain secure and has notified Australian cybersecurity authorities about the breach.
A spokesperson for Qantas confirmed the incident, stating, “We have been advised by global travel technology provider Amadeus that there has been unauthorized access to one of their systems.” The airline is currently working with Amadeus to determine whether any passenger booking information was compromised.
In its investigation, Amadeus found that certain booking-display data had been accessed by unauthorized parties. The company has since implemented security measures to address the vulnerability and reset any compromised credentials. They also fortified their monitoring and detection systems, while noting there were no signs of the vulnerability being exploited for ransomware attacks.
The unauthorized access reportedly occurred from August 2023 to September 2026, utilizing credentials assigned to an Amadeus system account. Cathay Pacific disclosed that around 53,000 bookings were impacted, with exposed records typically containing names, booking references, and flight details. A smaller segment also had email addresses, phone numbers, travel document data, and frequent flyer numbers affected.
Japan Airlines and Japan Transocean Air reported approximately 92,000 affected customers. Of those, around 90,000 had basic reservation information exposed, while another 2,000 experienced additional personal information breaches, including passport numbers and contact information. ANA confirmed that about 37,800 customers were affected, with 1,700 among them having personal data compromised.
Airlines such as Malaysia Airlines, Korean Air, and Asiana Airlines have also reported exposure linked to Amadeus systems, though the overall number of affected customers across all carriers is still being determined. Amadeus has not identified any evidence of the compromised information being misused.
While no financial data has been proven to be at risk, the exposure of booking references and personal identifiers poses a potential vulnerability for targeted phishing attempts. Japan Airlines has begun contacting affected customers, and Cathay Pacific is reviewing the impacted records before issuing notifications. Passengers are advised to remain vigilant against suspicious communications requesting personal or financial information.
