Amadeus breach tally grows as Singapore Airlines counts 46,000 records

The incident may have exposed a name, itinerary and booking class for anyone who booked with an affected carrier between August 2023 and September 2026. It also took passport, phone and frequent flyer details from a smaller group. No carrier has published a combined total. A passenger reading one airline's notice cannot see how far the incident runs. It is still open whether Amadeus publishes its own scope statement, and what regulators do next.

Singapore Airlines puts a number on it

The incident exposed more for about 620 of the 46,000 records. A spokesperson told AsiaOne and The Straits Times that an unauthorised party may also have accessed email addresses, phone numbers, travel document details and KrisFlyer membership numbers.

Amadeus has confirmed that the incident did not expose bank account or credit card information and did not modify any booking. Singapore Airlines said the incident stayed within Amadeus' platform. No one breached the airline's own IT systems. The airline is contacting affected customers with upcoming travel to change their booking reference numbers. It says it has informed the relevant authorities.

One supplier, many carriers, no total

Cathay Pacific said the incident affected about 53,000 bookings. Most of those records held booking references, passenger names and flight details. Japan Airlines and Japan Transocean Air reported about 92,000 affected customers. All Nippon Airways put its figure at about 37,800 customers, including 1,700 whose records held additional personal information.

Malaysia Airlines said the incident may have affected information processed through Amadeus between August 2023 and September 2026. It did not give a customer count. Korean Air and Asiana Airlines have reported unauthorised access. Neither has said how many customers the incident involved. Qantas has not published a figure. It said it is working with Amadeus to establish whether the incident compromised any of its passengers' booking information.

The figures do not add up, and not because of rounding. Cathay counts bookings while the Japanese carriers count customers. A single booking can cover several travellers, so summing them would not produce a reliable total of passengers.

How the access worked

According to Cathay Pacific's account, an unauthorised party used login credentials assigned to an Amadeus system account to reach reservation data. Amadeus described a vulnerability affecting a travel booking display environment. The vulnerability made certain booking-display data accessible.

The company says it has fixed the vulnerability and strengthened monitoring and detection. It also says there is no evidence that anyone accessed payment or financial data. It has found no indications that anyone used the flaw for ransomware.

Notifications went out in waves. Cathay Pacific received notice on 28 October and received further details the next day. Qantas said Amadeus told the carrier it had contained the issue in September 2026. Qantas said its own systems and databases remain secure.

A repeat for Singapore Airlines

Singapore Airlines has been here before. Reports say the Amadeus incident is the third data breach affecting the carrier since February 2021. The first came that year. A breach at air transport IT firm Sita compromised membership numbers and tier status for 580,000 KrisFlyer and PPS members. In 2022, a phishing attack hit the carrier's in-flight retailer KrisShop and exposed data on 4,749 customers.

The 46,000 records here are smaller than the 2021 figure. The difference is the route: this time the data sat with a supplier that many airlines share.

What is still open

The total number of affected customers across all carriers remains unknown. Malaysia Airlines did not say how many customers the incident involved or which categories of personal data it affected. Amadeus did not respond to a question from The Straits Times on how much data the incident affected. The carriers' notices establish a common supplier. They do not show that every airline used the same affected application or account.

Several affected airlines have advised customers to watch for suspicious emails, fraudulent phone calls and other messages asking for personal or financial information. Amadeus says its investigations continue. It says it is in direct communication with customers and relevant authorities.