The Amadeus airline breach: which airlines, what leaked, and what to do
You may never have heard of Amadeus, but if you have flown on a major airline, your booking probably went through it. For three years someone could read reservation data there. Here is the airline-by-airline picture and the few things worth doing before your next trip.
Between August 2023 and September 2026 someone used an Amadeus system account to read airline booking data. Amadeus runs reservations for hundreds of airlines. Japan Airlines (about 92,000 customers), Cathay Pacific (about 53,000 bookings), Singapore Airlines (about 46,000 booking records), ANA (about 37,800 passengers), Korean Air, Asiana and Malaysia Airlines have confirmed exposure; Qantas is checking. Most records hold a name, booking reference and flight details; a small share also hold contact details, passport details or frequent flyer numbers. No payment data, the companies say. There is no lookup. Be suspicious of any message about your booking and check trips only in the airline’s own app.
The airlines that have spoken so far
The figures are not comparable with each other: Cathay and Singapore Airlines count bookings, Japan Airlines and ANA count people, and a booking can cover several passengers. Amadeus has not given a total.
| Airline | How many | What was in the records | What the airline said |
|---|---|---|---|
| Japan Airlines (with Japan Transocean Air) | About 92,000 customers | Booking details; for about 2,000 people also extra personal data such as passport numbers. | Disclosed the week of 26 October. |
| Cathay Pacific | About 53,000 bookings | Mostly passenger name, booking reference and flight details. A smaller group may also include email, phone, travel document details or frequent flyer number. No payment data, per Cathay. | Told by Amadeus on 28 October, public on 30 October. Will contact customers individually. |
| Singapore Airlines | About 46,000 booking records | Names, booking references, itineraries and booking class. For about 620 records also email, phone, travel document details and KrisFlyer number. | Announced 3 November. Reissuing booking references for upcoming trips; Singapore’s privacy regulator is investigating. |
| All Nippon Airways (ANA) | About 37,800 passengers | Booking information; details beyond that not published in English-language reporting. | Disclosed late October. |
| Korean Air and Asiana Airlines | Not disclosed | Customer booking data. | Alerted customers on 23 October after Amadeus told them on 20 October. |
| Malaysia Airlines | Not disclosed | Bookings processed through Amadeus between August 2023 and September 2026 may be affected. | Statement dated 31 October; says its own systems were not compromised. |
| Qantas | Under review | Working with Amadeus to find out whether Qantas bookings were caught up. | Confirmed it is looking into it; has told Australia’s cyber agencies. |
Sources: Cathay Pacific’s statement as reported by Reuters (30 October 2026) and IBTimes UK; The Business Times on Japan Airlines, ANA, Korean Air and Asiana; Malaysia Airlines’ statement of 31 October; Singapore Airlines as reported by Reuters and The Star (3–5 November 2026); Qantas via News.com.au. Status as of 6 November 2026.
1. What happened, in order
According to Cathay Pacific, someone used login credentials belonging to an Amadeus system account to read reservation data, and the access stretched from August 2023 to September 2026. Amadeus says it fixed a vulnerability in a booking display environment and contained the problem in September. It then told airlines between 20 and 28 October. Korean Air and Asiana went public first, followed by Japan Airlines, ANA, Cathay Pacific on 30 October, Malaysia Airlines and Singapore Airlines. Amadeus has not said how many airlines or passengers are involved in total.
2. Why a booking record matters
A booking reference and your surname are what most airline sites ask for to open a reservation. Together with your route and travel dates, they let a scammer write a message only the airline should be able to write: “Your flight SQ 26 on 14 December has a schedule change, confirm here.” That is the real risk here, more than identity theft. A message that knows your trip is far more convincing than a generic phishing email.
3. The honest answer to “am I in it”
There is no lookup. The airlines are writing to affected customers, and some will take weeks to finish analysing the data. If you booked with one of the carriers in the table during those three years, assume your booking may be included. The data has not shown up in the known breach databases, so an email checker will not tell you either way.
4. Treat “change to your booking” messages as suspect
For the next few months, do not click links in emails or texts about schedule changes, seat upgrades, refunds, compensation or “unpaid fees”, even when they quote your real booking. Open the airline’s app or type its web address yourself and look at the reservation there. Airlines do not ask you to pay a fee or re-enter card details through a link in a text. Holiday travel season makes this worse: more trips, more genuine changes, more cover for fake ones. Our guide to telling a real breach notice from a fake applies to airline letters too.
5. Lock down your frequent flyer account
Frequent flyer numbers were in some of the records, and miles are easy to steal and spend. Change the password on your loyalty account, turn on two-step verification where the airline offers it, and look over recent activity for redemptions you did not make. If you use the same password anywhere else, change it there as well. Our pages on recovering a hijacked Delta SkyMiles, United MileagePlus and American AAdvantage account walk through the same steps for the big US programmes.
6. If your passport details were included
Only a small share of records held travel document details: about 2,000 at Japan Airlines and about 620 at Singapore Airlines, for example. If your airline says yours was one of them, you do not automatically need a new passport, but you should know what someone can and cannot do with the number. Our guide to a leaked passport number covers when replacing it is worth the cost.
Your phone number and address make a fake call believable
A booking reference tells a scammer where you are flying. People-search sites tell them how to reach you and where you live. PersProtect finds your details on those sites, checks your email against known breach databases, and files the removals.
Check my exposure — free →The Amadeus breach, answered
What is Amadeus?
A Madrid-based travel technology company. Hundreds of airlines, plus travel agencies and hotels, use its systems to create, store and change reservations. When you book a flight on one of those airlines, your booking usually lives on Amadeus servers even though you never dealt with Amadeus directly.
I live in the US. Could my booking be in this?
Yes, if you flew or booked with one of the affected airlines between August 2023 and September 2026, including through a travel agent or a partner airline’s website. The breach was in Amadeus, not in a particular country. As of 6 November no US airline had said its own customers were affected, but the list has grown every few days.
Was my credit card stolen?
Amadeus and every airline that has spoken say there is no evidence that payment or financial information was accessed. What leaked is booking data: names, booking references, routes and dates, and for a smaller group contact details, passport details or frequent flyer numbers.
Can I check online whether my booking was exposed?
No. The data has not appeared in the known breach databases that email checkers search, and Amadeus has not published a lookup. The airlines are contacting affected customers themselves; Cathay and Singapore Airlines have said so explicitly. If you flew with one of them in that period, assume you may be included and treat booking-related messages with extra care.
Do I need a new passport?
Usually not. Only a small subset of records included travel document details, and a passport number alone does not let someone travel as you. If your airline tells you your passport details were in the data, read our guide to a leaked passport number and decide from there.
Should I cancel or rebook my trip?
No. Bookings were not altered, according to Amadeus. Check your reservation in the airline’s own app, and if the airline issues you a new booking reference, as Singapore Airlines is doing for upcoming trips, use the new one.
Your booking is out. Your contact details don’t have to be.
See which people-search sites publish your phone number and home address. It is free and takes about a minute.
Run my free exposure scan →