Amadeus Patches Booking Flaw as Six Asian Carriers Count Data Exposure

Cathay Pacific has confirmed that about 53,000 bookings were exposed through unauthorised access to passenger reservation data held by Amadeus, as the world's largest distribution technology vendor moved to patch a security vulnerability affecting records dating back to August 2023.

Amadeus IT Group, the Spain-based company that processes reservations for carriers worldwide, said in a statement shared with Business Times that it had implemented fixes and strengthened monitoring after "certain booking-display data was accessible through the vulnerability."

"Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed," Amadeus said. "There are no indications that this vulnerability has been exploited for ransomware purposes."

The company added that it remains in direct communication with its customers and relevant authorities.

Which airlines are affected, and by how much?

The disclosed exposure spans at least six carriers across Asia, with affected reservation records dating between August 2023 and September 2026 — a window that includes future bookings still held in the system.

• Cathay Pacific: about 53,000 bookings affected. Most records contained booking references, passenger names and flight details; a smaller number may have included email addresses, phone numbers, travel document information and frequent flyer numbers. Amadeus notified the airline on Oct 28 and provided further details the next day.
• Malaysia Airlines: certain customer information processed through Amadeus between August 2023 and September 2026 may have been affected, the carrier said on Oct 31. Its own IT systems were not compromised.
• Japan Airlines and Japan Transocean Air: about 92,000 customers affected in combined reports. Both were notified on Oct 23.
• All Nippon Airways: information relating to about 37,800 customers was accessed.
• Korean Air and Asiana Airlines: both reported unauthorised access to customer reservation data through Amadeus but did not disclose affected numbers. They were notified on Oct 20.

Cathay Pacific said the unauthorised access involved login credentials assigned to an Amadeus system account — not a breach of the airline's own infrastructure. Malaysia Airlines, ANA and Cathay Pacific all stated their systems and operations remained unaffected.

What does the incident mean for sellers of travel?

No airline has reported access to financial or payment information, and Amadeus says it has found no evidence of ransomware exploitation. But the scale of the exposure — at least 183,000 disclosed customer records across four reporting carriers — lands on the vendor that sits at the centre of global airline distribution, processing bookings for hundreds of carriers.

The compromised data set is the raw material of downstream fraud: names, flight details, travel document numbers, contact details and loyalty numbers. Several affected airlines have advised customers to stay alert for suspicious emails, fraudulent phone calls and other communications requesting personal or financial information — a warning that phishing risk, not direct payment theft, is the immediate concern.

Amadeus says its investigation is continuing. With notifications still emerging and two major carriers yet to disclose affected numbers, the full commercial and regulatory cost of the breach remains unmeasured.