Singapore privacy watchdog investigates Amadeus breach as airline counts grow

The breach may have exposed names, booking references and itineraries for travellers who booked on carriers using Amadeus between August 2023 and September 2026. A smaller group had more taken.

The exposure point was outside the airlines' own networks. That explains why multiple carriers disclosed within days of each other. It also explains why each statement insists internal systems held.

Singapore Airlines puts a number on it

SIA said on 3 November that data from about 46,000 booking records was accessed. It listed customers' names, booking reference numbers, travel itineraries and booking classes. For about 620 records, the breach may also have exposed email addresses, phone numbers, travel document details and KrisFlyer membership numbers. Amadeus confirmed the exposed data did not include bank account or credit card information. It also confirmed the breach did not modify any bookings. The airline is contacting affected customers with upcoming travel to change their booking reference numbers. It says it has informed the relevant authorities.

One vendor, several different numbers

Cathay Pacific put its own figure at about 53,000 bookings. Most contained booking references, passenger names and flight details. Japan Airlines and Japan Transocean Air reported about 92,000 affected customers. All Nippon Airways said the breach affected about 37,800 customers. The breach potentially exposed names, booking references, travel dates, routes and cabin classes for roughly 36,100. It potentially exposed passport numbers, nationality and contact details for about 1,700. ANA said the breach did not involve credit card numbers or account passwords.

Those figures do not add up to a total. Cathay counts bookings, while the Japanese carriers count customers. Amadeus has not published an overall number.

How the access happened

Cathay Pacific said the unauthorised access involved login credentials assigned to an Amadeus system account. Amadeus notified the airline on 28 October. It supplied further details the following day. Amadeus said certain booking-display data was accessible through the vulnerability. It also said it saw no indications of ransomware use involving the flaw. Cathay said the containment actions included a password reset.

Cathay Pacific said Amadeus has not identified evidence of misuse of the affected data.

Malaysia Airlines has not said how many customers the incident involved.

Amadeus says it is in direct communication with its customers and relevant authorities.

Qantas and the carriers still counting

Qantas said Amadeus advised it had contained the issue in September. It is working with the supplier to establish the impact on any Qantas bookings. The airline said its own systems and databases remain secure. It said it notified the Australian Cyber Security Centre and the Office of National Cyber Security. It has not confirmed any access to its passenger records.

Korean Air and Asiana Airlines received notification on 20 October. They have not disclosed how many customers the breach affected. Malaysia Airlines said the breach did not compromise its own IT systems. It said it found no evidence of access to financial information. Singapore Airlines said the incident stayed within Amadeus's platform.

Malaysia Airlines calls Amadeus its reservation technology provider. ANA and the two Japanese carriers describe it as their passenger service system provider.

What happens next

Singapore's Personal Data Protection Commission said its investigation is ongoing. Amadeus says its own investigations continue.

Several affected airlines have told customers to watch for suspicious emails and calls seeking personal or financial information.