Malaysia Airlines said Sunday that some customer information may have been affected by a security incident at Amadeus, its reservation-technology provider, covering data processed between August 2023 and September this year, Reuters reported. It is at least the fifth Asian carrier to report exposure, a sign of how much risk can sit with one supplier that hundreds of airlines depend on.
What Happened
Amadeus, a Spanish travel-technology company, says it found a vulnerability in a "travel booking display environment" through which certain booking-display data could be accessed. In an Oct. 1 statement on its website, the company said there was no evidence payment or financial data was accessed and no sign the flaw was used for ransomware. Japan Airlines said Amadeus has since put security measures in place. It has not said how many airlines or travelers are affected.
Malaysia Airlines said its own systems were not breached and it has no evidence financial information was accessed, and it urged customers to watch for unsolicited messages.
Japan Airlines said about 92,000 customers were affected, BleepingComputer reported. Amadeus told the airline that unauthorized access ran from Aug. 10, 2023, to Sept. 23, 2026. For most of those customers, the exposed data was reservation codes, names and flight details. For about 2,000, it also included passport numbers, nationalities, email addresses, phone numbers and frequent-flyer numbers. BleepingComputer said Japan Airlines' account indicates the flaw Amadeus first disclosed Oct. 1 was maliciously exploited.
Cathay Pacific said about 53,000 bookings were affected, mostly booking references, names and flight details, with more personal data in a smaller subset, Reuters reported. South Korea's Asiana Airlines and Korean Air have also confirmed impact, and All Nippon Airways announced a related breach, according to BleepingComputer, which cited local media for the ANA report. Amadeus has not said whether airlines in other countries were affected, BleepingComputer reported.
Why It Matters
Amadeus runs reservation, ticketing and check-in systems used by more than 400 airlines, along with airports and hotels, according to BleepingComputer. A single weakness in a shared platform therefore spreads across carriers that each did nothing wrong in their own systems, and disclosures are arriving one airline at a time rather than from the supplier.
For boards, the episode is a test of third-party risk: contracts should require prompt notice and scope details from critical suppliers. Real booking references and itineraries also make convincing bait, and Japan Airlines warned customers about phishing emails, fraudulent calls and fake websites, The Record reported. Corporate travel teams should alert frequent travelers.
What to Watch
Watch whether Amadeus publishes a total count of affected airlines and travelers, whether carriers outside Asia, including U.S. airlines, report exposure, and whether European data-protection authorities open inquiries.
