Amadeus Breach Spreads Across Asia’s Airlines as Singapore Airlines, JAL, ANA and Cathay Count More Than 230,000 Exposed Records

A breach at Amadeus, the travel technology giant whose software sits behind the reservation, ticketing and check-in systems of hundreds of airlines, is turning into one of the widest third-party incidents the aviation industry has seen this year. On Tuesday, Singapore Airlines became the latest carrier to confirm exposure, saying about 46,000 of its booking records were accessed. It joins Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air, Asiana Airlines, Jin Air and Malaysia Airlines on a growing list of carriers that have disclosed impact over the past two weeks.

Counting only the carriers that have published figures, the disclosed total already tops 230,000 customer and booking records. None of the airlines’ own systems were breached. The data was pulled from a platform they rent.

What Happened

According to Cathay Pacific’s incident notice, an unauthorized party accessed travel reservation data inside Amadeus systems using login credentials assigned to an Amadeus system account. Japan Airlines says the traces of outside access run from August 10, 2023 to September 23, 2026. That means the intruder may have had a window of more than three years before the activity was found.

Amadeus itself has described the root cause as a vulnerability in its travel booking display environment that made certain booking data accessible, PhocusWire reported. The company says it has fixed the flaw, reset passwords, added enhanced monitoring and detection, and found no evidence that payment or financial information was accessed or that the data has been misused.

Notifications reached airlines in waves. Korean Air and Asiana were told on October 20, JAL on October 23 and Cathay on October 28, according to New Straits Times and the carriers’ own statements.

The Airline-by-Airline Tally

• Japan Airlines and Japan Transocean Air: about 92,000 customers. For roughly 90,000 of them, the exposed fields were reservation code, name, flight date, sector and class. For about 2,000, the data also included email, phone number, passport number, nationality and frequent flyer number (JAL).
• Cathay Pacific: around 53,000 bookings, mostly booking reference, passenger name and flight details, with a smaller subset that may include contact details, travel documents or frequent flyer numbers (Cathay Pacific).
• Singapore Airlines: about 46,000 booking records, with roughly 620 that may also include email addresses, phone numbers, travel document details and KrisFlyer numbers (CNA).
• All Nippon Airways: about 37,800 customers, including about 1,700 whose additional personal details may have been exposed (PhocusWire).
• Jin Air: 1,454 passengers, with names, birth dates, mobile numbers and nationalities among the leaked fields (The Business Times).
• Korean Air, Asiana and Malaysia Airlines have confirmed exposure but have not published counts. Bloomberg reported that Germany’s Condor was also affected, and Qantas is checking whether its bookings were involved.

Why a Booking Reference Is More Dangerous Than It Looks

It is tempting to shrug off a breach with no card numbers in it. That would be a mistake. A booking reference plus a passenger’s last name is often all an airline website asks for to view, change or cancel a trip. That is why Singapore Airlines is contacting affected customers with upcoming travel to issue new booking references, a step most other carriers have not yet announced.

The bigger near-term risk is precision phishing. An attacker who knows your name, your route, your travel date and your cabin class can write a “flight change” or “refund pending” email or text that looks exactly like it came from your airline. For the smaller groups whose passport numbers and phone numbers were exposed, the fraud and identity-theft risk goes up further. Every affected airline has warned customers to watch for fake emails, calls and websites using its brand.

The Business Lesson: Your Vendor’s Login Is Your Attack Surface

For executives outside aviation, the Amadeus incident is a textbook case of concentrated third-party risk. A single platform provider serves a large share of the world’s airlines. One compromised system account and one flaw in a display environment were enough to reach customer data belonging to more than half a dozen separate brands. Each of them now carries the regulatory notifications, customer service load and reputational damage, even though none of their own networks were touched.

Three details should worry any board that relies on SaaS platforms for customer data:

• Dwell time. Access traces stretch back to August 2023. Whatever monitoring existed did not flag the activity for roughly three years.
• Credential-based access. The intruder used valid login credentials tied to a system account, the kind of non-human account that often lacks multi-factor authentication, rotation or close monitoring.
• Staggered disclosure. Customers learned about the incident airline by airline over more than two weeks. That makes it harder for travelers to know whether they are affected and gives scammers time to work.

The practical takeaways are familiar but routinely skipped. Inventory every vendor that holds your customers’ personal data. Ask those vendors how service and system accounts are protected, rotated and monitored. Write breach-notification timelines and log-access rights into contracts. And keep an incident communications plan ready for a breach that happens somewhere other than your own network. It fits a broader pattern on Que.com’s security desk this week, from hijacked software update channels to stolen admin credentials, where attackers increasingly go after the trusted supplier instead of the target.

What Travelers Should Do Now

If you flew or booked with any of the named carriers since mid-2023, treat unexpected messages about your bookings with suspicion. Log in through the airline’s official app or website rather than clicking links. Change your frequent flyer password, turn on any extra login protection the airline offers, and request a new booking reference for upcoming trips if your carrier allows it. Anyone told their passport details were involved should watch for identity fraud and follow their airline’s guidance.

The Bottom Line

The Amadeus breach did not ground a single flight or expose a single card number, but it shows how one weak spot at a shared platform can quietly expose customers across an entire industry for years. Expect more airlines to report in the coming days, and expect regulators in Asia and Europe to ask hard questions about how long system-account access went unnoticed.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous