Qantas notifies Australian cyber authorities about Amadeus breach

Qantas has notified the Australian Cyber Security Centre and the National Office of Cyber Security about unauthorised access at Amadeus, Information Age reported. Qantas is working with the travel technology provider to understand the impact to any Qantas bookings, a spokesperson said.

Qantas assesses possible booking exposure

A Qantas spokesperson said there is "no impact to Qantas systems or databases which remain secure".

Amadeus identified unauthorised activity in its travel booking environment in September 2026, teiss reported. Information Age said Amadeus informed affected airlines in late October. Qantas said Amadeus told it the issue was contained in September; Beinsure reported Amadeus contained the incident in September 2026. The data at issue was processed between August 2023 and September 2026, Malaysia Airlines and Cathay Pacific said.

Why a vendor flaw reaches airline passengers

Amadeus supplies booking technology to more than 400 airlines, Information Age reported. The incident also hit hotels and car hire companies that run on its systems, 7NEWS reported.

Beinsure reported that compromised booking references, travel itineraries and personal identifiers could be used in targeted phishing or fraudulent messages impersonating airlines. Cathay said Amadeus had not identified evidence that the affected data was misused.

What Amadeus has confirmed

Amadeus said it became aware of a "vulnerability affecting a travel booking display environment". It said "certain booking-display data was accessible through the vulnerability". The company said it found no evidence that anyone accessed payment or financial data. It said it saw no indication anyone used the flaw for ransomware.

Cathay Pacific said the unauthorised party used login credentials assigned to an Amadeus system account. Amadeus notified Cathay on 28 October 2026 and supplied further information the following day, the airline said. Cathay said Amadeus confirmed a password reset and enhanced monitoring and detection. Amadeus says it is in direct dialogue with customers and authorities.

The counts carriers have published

Cathay Pacific said the incident affected 53,000 of its bookings, mostly passenger names, booking references and flight details. In a smaller subset, additional personal information including but not limited to email and phone contacts, travel document and/or frequent flyer number was potentially accessed, Cathay said. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said.

Japan Airlines and Japan Transocean Air reported about 92,000 affected customers, and ANA about 37,800, Beinsure reported. Singapore Airlines said about 46,000 booking records were affected, the Straits Times reported. Cathay and SIA counted booking records; Japan Airlines and ANA counted customers, so the figures are not directly comparable.

The earlier Qantas breach that sets the comparison

In July the Office of the Australian Information Commissioner published its report into the June 2025 Qantas breach, b2bnews reported. Information Age put the number affected at roughly 5.12 million Australians; b2bnews said about 5.67 million customer records were compromised. The privacy watchdog did not find Qantas had contravened its privacy obligations, Information Age reported.

What happens next

Malaysia Airlines urged customers to be wary of unsolicited messages seeking personal or financial information. Singapore Airlines said it was contacting affected customers with upcoming travel to change booking reference numbers.