Qantas, Japan Airlines, ANA, Cathay Pacific and Korean Air have been affected by a cybersecurity breach at Amadeus, the Spanish travel technology company that provides reservation and booking services to airlines, car rental operators and hotels worldwide.
The incident involved unauthorized access to an Amadeus system, potentially exposing passenger reservation records and booking information.
- Qantas and several major Asian airlines have been affected by unauthorized access to a system operated by Spanish travel technology provider Amadeus.
- Passenger reservation and booking information may have been compromised, although Amadeus reported no evidence of access to payment or financial data.
- Amadeus contained the incident in September 2026. Qantas confirmed its own systems remain secure and has notified Australian cybersecurity authorities.
We have been advised by global travel technology provider Amadeus that there has been unauthorised access to one of their systems.
A Qantas spokesperson confirmed the breach to NewsWire and identified Japan Airlines, All Nippon Airways (ANA), Cathay Pacific and Korean Air among the other affected carriers.
Qantas investigates potential exposure of passenger booking data
Amadeus informed Qantas that the unauthorized access had been contained in September 2026. The Australian airline is working with the technology provider to establish whether any of its passengers’ booking information was compromised.
Amadeus advised the issue was contained in September and we’re working with them to understand the impact to any Qantas bookings.
Qantas confirmed that the breach had not affected its internal technology infrastructure. To date there was no impact to Qantas systems or databases which remain secure
Amadeus reports no evidence of financial data exposure
Amadeus said its investigation found no evidence that payment or financial information had been accessed, although passenger reservation records were exposed through a vulnerability in its booking system.
The company confirmed that certain booking-display data had been accessible to unauthorised parties. It has implemented security measures to address the vulnerability, reset compromised credentials and strengthened monitoring and detection systems. Amadeus also reported no indications that the vulnerability had been exploited for ransomware attacks.
The unauthorised access involved credentials assigned to an Amadeus system account. According to affected airlines, the exposure extended from August 2023 to September 2026, although the precise scope remains under investigation.
- Cathay Pacific confirmed that approximately 53,000 bookings were affected. Most exposed records contained passenger names, booking references and flight details. A smaller number also included email addresses, telephone numbers, travel document information and frequent flyer numbers.
- Japan Airlines and Japan Transocean Air reported approximately 92,000 affected customers. Of those, around 90,000 had basic reservation information exposed, while another 2,000 had additional personal information compromised, including passport numbers, nationality, contact details and frequent flyer information.
- All Nippon Airways (ANA) separately confirmed that approximately 37,800 customers were affected, including 1,700 whose records contained additional personal information.
- Malaysia Airlines, Korean Air and Asiana Airlines have also reported exposure involving Amadeus reservation systems, although the total number of affected customers across all carriers remains unknown.
Amadeus has not identified evidence that the compromised information has been misused. Affected airlines reported that their own IT systems and flight operations remained unaffected.
Despite the absence of confirmed payment data exposure, compromised booking references, travel itineraries and personal identifiers could be used in targeted phishing attempts or fraudulent communications impersonating airlines.
Japan Airlines has contacted affected customers, while Cathay Pacific is reviewing the compromised records before issuing individual notifications. Airlines have advised passengers to remain alert to suspicious emails, phone calls and websites requesting personal or financial information.
