Amadeus booking breach: what airlines have disclosed so far

The Straits Times reported on 3 November that the 46,000 records at Singapore Airlines were tied to the Amadeus flaw. That is the newest hard number in a story that has been building for days. It is also the clearest sign yet that this is not a single-airline incident. It is a shared vendor problem.

Amadeus runs a reservations platform used by hundreds of carriers. Multiple reports say a vulnerability in that platform went unnoticed for a long stretch. shattered.io described the exposure as covering 38 months of airline data. PYOK, cited in the aggregated coverage, called the breach a three-year affair. Amadeus has since fixed the flaw, NST Online reported on 2 November. What is still missing is a single authoritative account of how many passengers were affected and what exactly was taken. Each airline has disclosed on its own schedule, with its own numbers. Some have stressed that their own systems were untouched.

Cathay Pacific and the 53,000 bookings

Cathay Pacific put a number on it first among the larger carriers: 53,000 bookings compromised, according to the Bangkok Post on 2 November. IDNFinancials and Aviation A2Z also reported that figure. That disclosure framed the incident as a cyberattack on the vendor rather than on the airline. That matters for how passengers should read the notices.

Malaysia Airlines took a different public line. The carrier said its IT systems were unaffected by the Amadeus breach, PenangToday reported on 2 November. It acknowledged that customers might still be caught up in it, per the Bangkok Post. The Star quoted the airline saying its own system was not compromised despite the vendor's cybersecurity breach.

The two statements are not contradictory, but they are easy to misread. An airline's own infrastructure can be clean while the reservations layer it rents from a supplier is not. Qantas, meanwhile, was still investigating possible exposure to booking data, Airways Magazine reported on 2 November. News.com.au grouped Qantas with several major airlines hit in the breach. News24 noted that carriers flying in and out of Australian airports were affected. Japan Airlines appears in the coverage as one of the carriers caught up in the incident, per the roundup published on 2 November.

Why one vendor reaches so many carriers

Booking systems are the least visible and most shared part of airline IT. A passenger buys a ticket from one brand. But the reservation record often lives in a platform operated by a third party that serves dozens of brands at once. When that layer fails, the blast radius is set by the vendor's customer list. No single airline's security budget sets it.

That is the structural point behind the Insurance Business headline on 2 November. It put vendor cyber risk in focus as the breach hit airlines globally. PhocusWire reported the same day that multiple airline partners were affected. The pattern is familiar from other sectors: the weakest link is rarely the brand on the boarding pass.

Amadeus has fixed the vulnerability, according to NST Online, but the disclosures from individual carriers have continued to arrive in the days since.

For travellers, the practical questions are narrower. Which records were opened, what fields did they contain, and does a compromised booking record create a risk of fraud or account takeover? Most of the disclosures so far do not answer all three. Cathay's 53,000 figure and Singapore Airlines' 46,000 are counts of bookings, not necessarily of people. A single booking can cover a family.

There is also a timing problem. If the exposure really ran for 38 months, as shattered.io reported, then some affected passengers may have flown and forgotten the trip entirely. Airlines that notify only recent customers could leave older ones uninformed. The 180-day notification window that applies to some platform operators in other contexts does not map neatly onto this case. None of the coverage establishes a single notification standard across carriers.

The disclosure pattern is the story

Look at the calendar. Cathay's number surfaced around 30 October, per the South China Morning Post. Malaysia Airlines' statement landed on 1 and 2 November. Qantas was still investigating on 2 November. Singapore Airlines' 46,000 arrived on 3 November. That is a slow, staggered release, each carrier calibrating its own message. No one has published a consolidated tally.

Business Traveller asked on 2 November whether hackers had accessed flight details. That is the question most passengers actually have. The honest answer from the public record is: at some carriers, yes, in some form; at others, the investigation is ongoing. Malaysia Airlines' insistence that its systems were untouched, reported by KLSE Screener and PenangToday, is a useful reminder. "Affected" in these stories can mean several different things.

None of this is unique to travel. The same third-party concentration risk shows up in payments, payroll and cloud hosting. What makes airline bookings distinctive is the data: names, contact details, itineraries and sometimes more. That data is held for millions of people who never chose the vendor.

Amadeus has not published a full account of the incident. Until it does, the numbers will keep arriving one airline at a time.