If you booked a flight in the last three years, this is the page to read before you click anything. Amadeus is the Spanish travel-tech company whose systems handle reservations, ticketing and check-in for a huge share of the world's airlines. In late October 2026, those airlines started telling passengers that booking data held in an Amadeus system had been accessed without authorisation.
This is the evergreen version: what happened, which airlines have actually spoken, and the exact steps to take if you might be affected. For the earlier news recap and scam examples, see our Amadeus data breach scams briefing.
TL;DR
- An unauthorised party used valid login credentials to reach travel reservation data in an Amadeus system.
- Japan Airlines and Thai Airways say traces of access ran from 10 August 2023 to 23 September 2026.
- The main data involved was names, booking references (PNRs) and flight details. A smaller group also had contact details, travel-document data or frequent-flyer numbers exposed.
- Airlines and Amadeus say there is no evidence payment or card data was accessed.
- The live risk is a convincing refund, cancellation or "reconfirm your booking" message that already knows your trip. Don't use the link. Open the airline's app yourself.
What happened in the Amadeus data breach?
Cathay Pacific's official notice is the clearest public account. Amadeus told the airline on 28 October 2026, with more detail the next day, that an unauthorised party had used login credentials assigned to an Amadeus system account to reach travel reservation data. That included Cathay bookings. Cathay says the access, according to Amadeus, took place between August 2023 and September 2026.
Japan Airlines and Thai Airways later published a tighter window: 10 August 2023 to 23 September 2026. JAL says it was first informed on 23 October.
Amadeus has told airlines it contained the issue in September, reset passwords, revoked the credentials used and added monitoring. Cathay says Amadeus has not identified evidence that the data was misused. Airline notices also say their own systems and flight operations were not breached.
What data was accessed?
Across the notices, the pattern is the same:
- Most records: passenger name, booking reference (PNR) and flight details such as date, route and cabin class.
- A smaller subset: extra personal data, which can include email address, phone number, travel-document or passport details, nationality, frequent-flyer number, ticket number or seat number.
- Not reported as accessed: payment or credit-card data. JAL also says passwords were not compromised. Singapore Airlines says no bookings were changed.
That split matters. Even without a card number, a name plus a real booking reference and flight is enough for a scammer to write a message that looks official.
Which airlines have confirmed an impact?
These are the figures the airlines themselves, or contemporaneous reporting of their statements, have given as of 10 November 2026. Totals are not comparable one-for-one (some count bookings, some count customers or passenger records), and Amadeus has not published a global total.
| Airline | What they've said | Source |
|---|---|---|
| Cathay Pacific | About 53,000 bookings. Most: name, booking reference, flight details. A smaller group may also include email, phone, travel-document or frequent-flyer data. | Cathay notice, 30 Oct 2026 |
| Japan Airlines and Japan Transocean Air | About 90,000 customers: PNR, name, flight date, sector and class. About 2,000 also had email, phone, passport number, nationality, frequent-flyer number, ticket or seat data. Total about 92,000. | JAL notice, 30 Oct 2026 |
| ANA | About 37,800 customers, of whom about 1,700 had extra personal data, as reported. | Airline statements as reported by Information Age |
| Singapore Airlines | About 46,000 booking records (names, booking references, itineraries, booking classes). About 620 may also include email, phone, travel-document details or KrisFlyer numbers. SIA is contacting affected customers with upcoming travel to change booking references. | CNA, 3 Nov 2026, citing SIA |
| Thai Airways | About 60,529 passenger records (name, PNR, travel date, routing, cabin class). About 376 may also include email, phone, passport number, nationality, frequent-flyer, ticket or seat data. Credentials used have been revoked. | Thai Airways, 9 Nov 2026 |
| Korean Air and Asiana | Some customer booking data accessed. No totals published. | Airline alerts, as reported |
| Malaysia Airlines | Data processed via Amadeus "may have been affected". No total published. | Airline statement, as reported |
| Qantas | Working with Amadeus to establish whether any Qantas bookings were affected. Says its own systems and databases remain secure. No confirmed customer total. | Qantas, as reported by The Canberra Times |
If your airline is not on this list, that does not automatically mean you are in the clear, or that you are affected. It means the airline has not, as of this update, published a confirmed impact figure. Watch the airline's official website, not forwards.
How do I know if I was affected?
- Cathay, JAL and Thai Airways say they will contact, or have contacted, affected customers directly.
- Singapore Airlines is reaching customers with upcoming travel so their booking references can be changed.
- A message that already quotes your flight number is not proof it came from the airline. That is exactly the data this incident exposed.
What to do if you might be affected
- Don't use the link in a surprise email, text or WhatsApp message. Open the airline's official app, or type the airline's address yourself, and check "Manage booking". If the airline really changed your flight, it will show up there.
- A real refund does not cost money. Anyone asking for a fee, a deposit, a card PIN or a code to "release" your refund is a scammer.
- If your airline asks you to change a booking reference (SIA has said it will do this for some upcoming trips), do it only inside the official app or website, or by calling a number printed on your ticket or the airline's site. Don't call a number that arrived in the same message.
- Turn on two-factor authentication on the email account used for tickets, and on frequent-flyer accounts. A passkey is stronger than an SMS code because it will not sign you in on a fake site.
- Change reused passwords. If your airline password is also your email password, change the email one first.
- If your passport details were in the smaller, more-exposed group, watch for unexpected accounts opened in your name. Don't rush to replace a passport unless the airline or a government agency tells you to.
- Report phishing. In the US, start at IdentityTheft.gov. In the UK, report to Action Fraud, forward scam texts to 7726 and scam emails to report@phishing.gov.uk. In Australia, use Scamwatch. Hong Kong's privacy watchdog, the PCPD, has already warned that people lost large sums after earlier breaches when scammers posed as companies offering refunds.
The same habits help after any vendor breach. Our note on the DreamHost FTP and webmail incident walks through the same "slow down, go to the source" approach.
What this is not
It is not a breach of every airline's own database. The airlines that have spoken say their systems were not compromised. It is also not, on the evidence published so far, a payment-card dump. Treat any message that says "your card was stolen, click here to lock it" with the same suspicion as a fake refund.
Figures will keep moving as more airlines finish their reviews. We'll update this page when official totals change. Until then, the useful move is the boring one: ignore the link, open the app, and lock down the email inbox the tickets arrived in.
Related on Factash
- Amadeus data breach: airlines hit and the scams to watch for
- What are passkeys? Passwordless login explained
- DreamHost data breach: FTP and webmail, what to do
FAQ
What is the Amadeus data breach?
Unauthorised access to an Amadeus airline reservation system, using valid login credentials, between 10 August 2023 and 23 September 2026. Airlines say names, booking references and flight details were the main data involved.
Which airlines were affected by the Amadeus data breach?
Cathay Pacific, Japan Airlines, ANA, Singapore Airlines, Thai Airways, Korean Air, Asiana and Malaysia Airlines have said customer booking data may be involved. Qantas is still checking whether its bookings were affected.
Was payment card or password data stolen?
Airline notices and Amadeus say there is no evidence that payment or card data was accessed. Japan Airlines also said passwords were not compromised.
How do I know if I was affected?
Wait for an email from the airline you flew with. Singapore Airlines is also contacting some customers with upcoming travel to change booking references. Don't trust a surprise message just because it already knows your flight details.
What should I do if I get a refund or rebooking message?
Don't use the link in the message. Open the airline's official app or type its website yourself and check the booking there. A real airline will not charge a fee to release a refund.
Main source: Cathay Pacific, "Personal data security incident involving a third-party service provider" (30 October 2026). Also referenced: Japan Airlines notice, Thai Airways notice (9 November 2026), CNA report of Singapore Airlines' statement, and Qantas comments as reported by The Canberra Times.
Image credits
- Featured graphic: Factash original.
