Your flight details might be sitting in a hacker's notes app. Not your card. Your trip. And honestly? That's the part scammers love most.
The Amadeus data breach is the big travel-security story this week. Amadeus is the Spanish tech company whose systems run reservations, ticketing and check-in for a huge chunk of the world's airlines. Someone got into one of its systems, and airlines are now telling passengers their booking data may be exposed. If you flew in or out of Asia since mid-2023, from the US, the UK or anywhere, read this.
TL;DR - Affected airlines say the unauthorised access ran from August 2023 to September 2026. Amadeus says it was contained in September. - Confirmed so far: Cathay Pacific (~53,000 bookings), Japan Airlines (~92,000 customers), ANA (~37,800 passengers), plus Korean Air, Asiana and Malaysia Airlines. Qantas is still checking. - Mostly names, booking refs and flight details. A smaller group had passport numbers, contact details or frequent-flyer numbers exposed. - No evidence of payment data being accessed, per the airlines. - The real risk now: super-convincing "refund" and "booking problem" phishing.
What Happened in the Amadeus Data Breach?
According to Cathay Pacific's statement, reported by news.com.au, Amadeus told the airline that unauthorised access to its system happened between August 2023 and September 2026. That's three years before anyone caught it. Cathay was notified on 28 October.
Korean Air and Asiana say their investigation points to someone using login details belonging to an Amadeus system account, according to The Contrail's tracker. So it wasn't some movie-style break-in. Someone used valid credentials. (Yep, passwords strike again.)
Cathay says Amadeus has since reset passwords and added extra monitoring, and has "not identified evidence that the affected data has been misused."
Which Airlines Are Affected?
| Airline | What they've said |
|---|---|
| Cathay Pacific | ~53,000 bookings. Mostly names, booking refs, flight details. Some contact, travel-document and frequent-flyer info |
| Japan Airlines + Japan Transocean Air | ~92,000 customers. About 2,000 had extra data, including passport numbers |
| ANA | ~37,800 customers. About 1,700 had extra personal data |
| Korean Air, Asiana | Booking numbers for some customers accessed. No total given |
| Malaysia Airlines | Data processed via Amadeus "may have been affected". No total given |
| Qantas | Still checking. Says its own systems are secure |
Figures from Beinsure, The Contrail and the airlines' statements as reported. Amadeus hasn't said how many airline customers were hit.
Why This Matters Even If Your Card Is Safe
Here's the plot twist. Scammers don't need your card number when they know your name, your booking reference and your exact flight. That's enough to send a message that looks 100% legit:
- "Your flight CX___ on 14 Nov was cancelled. Claim your refund here."
- "We need to re-verify your passport for your upcoming trip."
- "Pay a small rebooking fee to keep your seat."
This isn't theoretical. Hong Kong's privacy watchdog, the PCPD, says people have already lost from HK$10,000 to more than HK$1.5 million in fraud after recent breaches. Scammers used leaked purchase and flight details to pose as companies offering refunds and compensation. Its warning: real merchants never ask for deposits, handling fees or bank transfers to "verify" you.
How to Protect Yourself (US and UK Travellers, This Is for You)
- Never use the link in the message. Open the airline's app or type the URL yourself. If there's a real problem, it'll show up in "Manage booking".
- No legit refund costs money. Any "fee to release your refund" = scam. Full stop.
- Turn on 2FA everywhere, especially email and frequent-flyer accounts. Points get stolen too. A hardware security key is the strongest option because it won't log in to fake sites.
- Change reused passwords. If your airline password is also your Gmail password, fix that today.
- Watch for passport misuse. If you were in the passport-data group, keep an eye on any unexpected account sign-ups in your name. UK readers can report fraud to Action Fraud. US readers can use IdentityTheft.gov.
- Report the phish. In the UK, forward scam texts to 7726 and scam emails to report@phishing.gov.uk.
Want the bigger picture? Check out AI cybersecurity threats to watch in 2026 and our cybersecurity checklist.
The Bottom Line
The Amadeus breach is a reminder that your data's safety depends on companies you've never heard of. You can't fix their passwords. You can make sure a fake refund email gets nothing from you. Slow down, go to the source, and lock your accounts with real 2FA.
For more like this, browse more cybersecurity explainers or the full Cybersecurity section.
FAQ
What is the Amadeus data breach?
Unauthorised access to an Amadeus system that handles airline bookings. Affected airlines say the access ran from August 2023 to September 2026, and Amadeus says it was contained in September 2026.
Which airlines were affected by the Amadeus breach?
Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana and Malaysia Airlines have said customer booking data may be involved. Qantas is still checking whether its bookings were affected.
Was payment card data stolen?
Airlines say there is no evidence that financial or payment data was accessed. Names, booking references and flight details were the main data involved, with passport and contact details for a smaller group.
How do I know if a refund email from an airline is real?
Don't use the link in the message. Open the airline's app or type its website yourself, and check your booking there. Real airlines won't ask for a fee or your card PIN to process a refund.
