Amadeus Data Breach 2026: Airlines Hit & What to Do

Last updated 11 Nov 2026

If you booked a flight in the last three years, start here. Amadeus is the Spanish travel-tech company whose systems handle reservations, ticketing and check-in for hundreds of airlines. From late October 2026, those airlines began telling passengers that booking data held in an Amadeus system had been accessed without authorisation.

This hub collects the official notices, what was and wasn't leaked, a checklist, and the scam warning signs. For a shorter action guide, see Amadeus Data Breach: What Happened and What to Do. For phishing examples, see our scams briefing.

Main source: Cathay Pacific's official notice (30 October 2026). Later airline disclosures and Amadeus's statement, as reported by The Record, are linked below.

TL;DR

An unauthorised party used valid login credentials assigned to an Amadeus system account to reach travel reservation data from 10 August 2023 to 23 September 2026, according to Japan Airlines, ANA and Thai Airways.

Most records involved names, booking references (PNRs) and flight details. A smaller group also had contact, passport or frequent-flyer data.

Airlines and Amadeus say there is no evidence payment or card data was accessed.

The live risk is a convincing refund or "reconfirm your booking" message that already knows your trip. Don't use the link. Open the airline's app yourself.

Amadeus has not published a global total. The figures below use different units (bookings, customers or reservations) and should not be added together.

What happened, and when?

Cathay Pacific's official notice is the clearest public account of how the access happened. Amadeus told the airline on 28 October 2026, with more detail the next day, that an unauthorised party had used login credentials assigned to an Amadeus system account to reach travel reservation data, including Cathay bookings. Cathay says the access, according to Amadeus, took place between August 2023 and September 2026.

Japan Airlines, ANA and Thai Airways later published a tighter window: 10 August 2023 to 23 September 2026. JAL says it was first informed on 23 October. Korean Air was notified on 20 October, according to The Asia Business Daily, quoting the airline.

A spokesperson for Amadeus told The Record that a vulnerability in a travel booking display environment had made "certain booking-display data" accessible, that there was no evidence payment or financial data was accessed, and that there were no signs it had been used for ransomware. Amadeus said it had fixed the vulnerability, added monitoring, and was in dialogue with customers and authorities. It declined to give a global total, or say whether the attackers had contacted the company. Airline notices also say the credentials used have been reset or revoked, and that the airlines' own systems and flights were not breached.

Which airlines have confirmed an impact?

These are the figures the airlines themselves, or contemporaneous reporting of their statements, have given as of 11 November 2026. If your airline is not listed, that does not automatically mean you are in the clear, or that you are affected. Watch the airline's official website, not forwards.

Airline	What they've said	Source
Cathay Pacific	About 53,000 bookings. Most: name, booking reference, flight details. A smaller group may also include email, phone, travel-document or frequent-flyer data.	Cathay, 30 Oct 2026
Japan Airlines and Japan Transocean Air	About 92,000 customers in total. About 2,000 also had email, phone, passport, nationality, frequent-flyer, ticket or seat data.	JAL, 30 Oct 2026
ANA	About 37,800 customers who booked between 10 August 2023 and 23 September 2026. About 1,700 also had extra personal data, including passport or contact details.	ANA, 30 Oct 2026
Singapore Airlines	About 46,000 booking records. About 620 may also include email, phone, travel-document or KrisFlyer data. SIA is changing some upcoming booking references.	CNA, 3 Nov 2026, citing SIA
Thai Airways	About 60,529 passenger records. About 376 may also include extra personal data such as passport or contact details.	Thai Airways, 9 Nov 2026
Korean Air and Asiana	Reservation data accessed. Asiana said payment information was not included. No totals published.	Officials quoted by The Asia Business Daily, 23 Oct 2026
Malaysia Airlines	Some customer data processed through Amadeus between August 2023 and September 2026 "may have been affected". No total. No evidence financial data was accessed.	Malaysia Airlines, 30 Oct 2026
Star Flyer	Some customers who booked from 28 July 2025 to 23 September 2026. No total yet. Uses Amadeus through ANA.	Star Flyer, 30 Oct 2026
Finnair	About 116,000 reservations were on affected flight lists. About 750 were opened for examination, including 30 tied to Aurinkomatkat packages. New reservation numbers were issued for still-active ones.	Finnair, 9 Nov 2026
SAS	350,164 people, according to SAS as reported by SVT. Mainly older or completed bookings: references, dates, flight details and passenger counts. No further personal-data categories identified so far.	SVT, 9 Nov 2026, quoting SAS
Norwegian	Confirmed it is affected and has notified Norway's data protection authority. No passenger total given.	Spokesperson to NRK, 6 Nov 2026
Qantas	Still checking whether any Qantas bookings were affected. Says its own systems remain secure. No confirmed total.	Qantas, as reported by The Canberra Times

SAS, as reported by SVT, has told Sweden's privacy authority (IMY) about the incident and, for now, will not notify passengers individually because it does not assess the GDPR risk as high. That decision may change.

What data leaked, and what didn't?

Factash graphic comparing data usually accessed in the Amadeus breach, such as names and booking references, with payment cards and passwords, which airlines say were not accessed

Across the airline notices, the pattern is consistent:

Most records: passenger name, booking reference (PNR) and flight details such as date, route and cabin class.
A smaller subset: extra personal data, which can include email, phone, travel-document or passport details, nationality, frequent-flyer number, ticket number or seat number.
Not reported as accessed: payment or credit-card data. Japan Airlines, ANA, Star Flyer and Finnair also say passwords were not compromised. Amadeus, as reported by CNA, said no bookings were changed.

Norway's National Security Authority (NSM), citing Amadeus, has said that depending on the type of booking the actor may also have been able to see special-service requests, travel-agency details and free-text remarks. That is broader than the lists some airlines have published, and it has not been confirmed airline by airline. Treat it as a possibility, not a fact about every record.

Even without a card number, a name plus a real booking reference and flight is enough for a scammer to write a message that looks official.

How do I know if I was affected?

Cathay, Japan Airlines, ANA, Thai Airways, Star Flyer and Finnair say they will contact, or have contacted, affected customers. Finnair also points people to dataprotection@amadeus.com, and says Amadeus is the data controller for the affected service.
Singapore Airlines is contacting customers with upcoming travel so their booking references can be changed.
SAS has said, as reported by SVT, that it will not individually notify passengers for now.
A message that already quotes your flight number or booking reference is not proof it came from the airline. That is exactly the data this incident exposed.

If you have not heard from your airline, check its official website or app. Don't assume silence means you were missed, and don't assume a detailed message is genuine.

What to do now: a step-by-step checklist

Don't use the link in a surprise email, text or WhatsApp message. Open the airline's official app, or type its address yourself, and check "Manage booking".
A real refund does not cost money. Anyone asking for a fee, a deposit, a card PIN or a one-time code to "release" your refund is a scammer.
If your airline asks you to change a booking reference (Singapore Airlines and Finnair have said they will do this for some still-active trips), do it only inside the official app or website, or by calling a number printed on your ticket or the airline's site. Don't call a number from the same message.
Turn on two-factor authentication on the email used for tickets, and on frequent-flyer accounts. A passkey is stronger than an SMS code because it will not sign you in on a fake site.
Change reused passwords. If your airline password is also your email password, change the email one first.
If your passport details were in the smaller, more-exposed group, watch for unexpected accounts opened in your name. Don't rush to replace a passport unless the airline or a government agency tells you to.
Report phishing. In the US, start at IdentityTheft.gov. In the UK, report to Action Fraud, forward scam texts to 7726 and scam emails to report@phishing.gov.uk. In Australia, use Scamwatch. In India, report at the National Cyber Crime Reporting Portal.

The shorter walk-through is in our what-to-do guide.

Refund and phishing scam warning signs

The most likely follow-up is not a stranger charging your card. It is a message that already knows your name, flight and booking reference, and asks you to claim a refund, reconfirm your seat, or re-verify your passport.

Treat it as a scam if it asks you to click a link or call a number in the message; demands a fee, PIN, one-time password or a copy of your passport to "unlock" a booking or refund; or uses urgency and a slightly off airline name or domain.

For worked examples, see our Amadeus breach scams briefing. The habit is the same after any vendor breach: slow down, go to the source, and lock the inbox the tickets arrived in.

Latest updates

9–10 November 2026: SAS said 350,164 people may be involved, as reported by SVT. Thai Airways published a notice covering about 60,529 passenger records. Finnair said about 116,000 reservations were on affected flight lists, with about 750 opened for examination. Qantas has still not confirmed an impact.
6 November 2026: Norwegian confirmed to NRK that it is affected, but gave no total. NSM said the vulnerability was closed on 23 September 2026.
3 November 2026: Singapore Airlines said about 46,000 booking records were accessed, and that it is changing some upcoming booking references, according to CNA.
30 October 2026: Cathay Pacific, Japan Airlines, ANA, Malaysia Airlines and Star Flyer published notices. Korean Air and Asiana had already confirmed an impact, without totals, as reported by The Asia Business Daily.

We will update this page when official totals change.

Related on Factash

FAQ

What is the Amadeus data breach?

Unauthorised access to travel reservation data in an Amadeus system, using valid login credentials assigned to an Amadeus system account, between 10 August 2023 and 23 September 2026. Airlines say names, booking references and flight details were the main data involved.

Which airlines were affected by the Amadeus data breach?

Cathay Pacific, Japan Airlines, ANA, Singapore Airlines, Thai Airways, Korean Air, Asiana, Malaysia Airlines, Star Flyer, Finnair, SAS and Norwegian have said customer booking data may be involved. Qantas is still checking whether its bookings were affected. Amadeus has not published a global total.

Was payment card or password data stolen?

Airline notices and Amadeus say there is no evidence that payment or card data was accessed. Japan Airlines, ANA, Finnair and Star Flyer also said passwords were not compromised. Amadeus, as reported by CNA, said no bookings were changed.

How do I know if I was affected?

Wait for an official email from the airline you flew with, or check its app or website yourself. Singapore Airlines and Finnair have also been changing some still-active booking references. Don't trust a surprise message just because it already knows your flight details.

What should I do if I get a refund or rebooking message?

Don't use the link in the message. Open the airline's official app or type its website yourself and check the booking there. A real airline will not charge a fee to release a refund.

What data was leaked in the Amadeus breach?

Most records involved names, booking references and flight details. A smaller group may also have had email, phone, passport or travel-document details, or frequent-flyer numbers accessed. Amadeus and the airlines say there is no evidence payment data was accessed.

Main source: Cathay Pacific official notice (30 October 2026). Also referenced: The Record (Amadeus statement), Japan Airlines, ANA, Thai Airways, Malaysia Airlines, Star Flyer, Finnair, CNA (Singapore Airlines), The Asia Business Daily (Korean Air and Asiana), SVT (SAS), NRK (Norwegian), Norway's NSM, and The Canberra Times (Qantas).