What happened 

Amadeus builds and maintains the reservation, ticketing and check-in platforms that many airlines depend on. Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have each reported data breaches traced to Amadeus over the past week. More than a hundred airlines run on Amadeus systems, and its Altéa passenger platform is used by around 130 airlines.  

Amadeus told Recorded Future News that it recently became aware of a vulnerability affecting a travel booking display environment, and that certain booking-display data was accessible through it. The company says there is no indication the vulnerability was exploited for ransomware, and that it has fixed the flaw and enhanced monitoring and detection.  

The timeline 

• August 2023: Reporting dates the breach window from August 2023 to September 2026. That is roughly 37 months of exposure.  

• September 2026: The flaw was reportedly fixed in September 2026. Qantas relayed Amadeus’s message that the problem was “contained in September.”  

• October 20: Korean Air and Asiana were notified, followed by JAL on October 23 and Cathay on October 28.  

• October 23: Korean Air and Asiana published customer alerts. 

• November 1 to 3: Malaysia Airlines warned customers, and Singapore Airlines disclosed about 46,000 affected booking records on November 3.  

• November 4: Singapore’s Personal Data Protection Commission confirmed it is aware of the matter and investigating. 

The notification lag matters. Airlines learned of the problem weeks after Amadeus says it contained it, and years after access reportedly began. 

How it happened: two accounts that don’t fully match 

Amadeus’s own wording points to a “vulnerability.” The airlines describe something different. Cathay Pacific said Amadeus told it a threat actor used login credentials assigned to a system account. Malaysia Airlines’ account describes stolen administrative credentials used to view reservation screens.  

The two accounts can both be true. A weakness in a booking-display environment, such as weak access control on a system account, could let valid credentials reach far more data than they should. Amadeus has not published a technical root cause, and no indicators of compromise have been released publicly. 

For CISOs, the credential-abuse reading is the more instructive one. A valid login looks like normal activity, so it generates no malware alert or exploit signature. Detecting it depends on behavioral analytics, and that is what apparently failed for 37 months. 

What was exposed 

The core data is consistent across carriers: names, booking reference numbers, travel itineraries and booking classes. A smaller subset had more:  

A warning on the numbers: don’t add these up and call it a total. Cathay counts bookings while the Japanese airlines count customers, and records may overlap between carriers. One outlet tallied more than 230,000 records, but treat that as a floor of disclosed figures rather than a verified count.  

Qantas and Condor are unconfirmed. Qantas is investigating whether its bookings were affected. Condor’s involvement rests on a single outside report that has not been independently confirmed.  

Payment data: Amadeus said it found no evidence that payment or financial data was accessed, and Japan Airlines said card numbers and passwords were not compromised.  

Who is behind it? 

Nobody knows. No threat actor has claimed responsibility, and there is no indication yet that the data has surfaced on the dark web. Some analysts suggest the pattern fits financially motivated criminals or initial access brokers, but that is inference. It is not attribution. A three-year dwell time points to a quiet, patient actor, but it could just as easily reflect poor logging as sophistication. 

Why this matters: the real risks 

1. Targeted phishing. A genuine booking reference, name and itinerary make a scam email far more convincing. Attackers can send highly personalized phishing emails that appear to come from the airline and reference real flight details. That includes fake refund or rebooking requests. Singapore Airlines is contacting customers with upcoming flights to change their exposed booking numbers and urging caution with suspicious emails. 

2. Identity risk for the passport subset. Passport numbers combined with contact details and nationality are durable identifiers. Unlike a password, they can’t be reset. 

3. Corporate and executive travel exposure. Itineraries reveal who is traveling where and when. For executives, officials and sensitive industries, that is useful intelligence for social engineering or physical targeting. 

4. Regulatory exposure. Regulators are already engaged. For airlines, the lesson from Qantas’s 2025 breach is that outsourcing the system doesn’t outsource accountability. The Australian regulator’s review of that breach, which involved a third-party contact centre, examined whether Qantas took reasonable steps to oversee its contractor. 

The OT and aviation security angle 

Let’s be precise about the OT impact: no source has identified an aviation safety investigation or any impact on aircraft operation. This is a data exposure incident, not an operational disruption. 

It still belongs in an OT security conversation, for three reasons. 

Shared infrastructure is the real attack surface. Airlines say their own networks were clean, and that appears true. All of that can be true and customers can still be exposed. A single vendor environment sat behind multiple national carriers. In aviation, resilience depends on the weakest shared platform. 

The boundary between IT and operational systems is porous. Reservation and check-in data feeds departure control, crew planning and airport operations. A compromise limited to booking display today could become an integrity or availability problem tomorrow if an attacker moves from reading to writing. That is a risk scenario, not a finding in this case. 

This is a pattern. In 2021, SITA’s passenger system was breached, hitting Singapore Airlines, Malaysia Airlines, Lufthansa and others. In 2019, a researcher found a vulnerability in Amadeus’s booking system that made it easy to access or alter traveler records. Airlines have seen vendor-concentration incidents before, and the sector’s structural exposure hasn’t changed. 

What organizations should do now 

If you are an airline, airport or aviation operator: 

1. Inventory every vendor connection to your passenger and operational data, including service accounts and API credentials. Most organizations undercount. 

2. Demand credential governance from vendors in contracts. Require MFA on administrative and service accounts, credential rotation schedules, and privileged-access logging. 

3. Require breach notification SLAs. Learning of a 37-month compromise weeks after containment is a contract failure as much as a technical one. 

4. Ask for log-retention and anomaly-detection evidence. Query volumes, geographies and access hours for non-human accounts should be baselined and alerted on. 

5. Pre-draft the passenger communications. Rotate exposed booking references and prepare anti-phishing messaging before an incident, as Singapore Airlines did. 

6. Segment passenger-data systems from operational systems, and test that segmentation. 

If you are a CISO at any organization with critical vendors: 

• Treat non-human accounts as high-risk assets. Service accounts rarely get MFA, rarely get reviewed, and often hold broad permissions. 

• Map concentration risk. If one vendor outage or breach would affect many of your business lines, it belongs on the board risk register. 

• Run a tabletop on a “vendor breached, you were never alerted” scenario. 

If you are a traveler or travel manager: 

• Treat unsolicited emails about bookings with suspicion, even when they contain correct details. Go to the airline’s website directly. 

• Corporate travel teams should flag high-profile travelers whose itineraries may be exposed. 

• Passport-affected individuals should watch for identity misuse. 

Open questions 

• What exactly was the initial access vector, and how was the credential obtained? 

• Why did 37 months of access go undetected? 

• Will Amadeus publish indicators of compromise so other customers can hunt? 

• How many total passengers are affected once Korean Air, Asiana and Malaysia Airlines publish counts? 

• Will regulators in Singapore, Japan, South Korea and Hong Kong levy findings against Amadeus, the airlines, or both? 

We will update this analysis as answers emerge. 

Key takeaways 

The Amadeus incident is not a story about aircraft being hacked. It is a story about trust concentration. A single vendor’s account governance gap reportedly exposed passengers of multiple airlines for over three years, and the airlines themselves had no visibility into it. Security leaders should assume their most important dependencies are also their least visible risks. 

Shieldworkz helps aviation, critical infrastructure and industrial operators assess third-party and supply-chain exposure across IT and OT environments. Contact our team to review your vendor access model.