Amadeus IT Group breach — Asian airlines report customer data theft via booking-display vulnerability
Severity: medium · Patch status: no-fix-needed · Since 2026-10-28
A vulnerability in Amadeus IT Group's travel booking display environment was exploited by attackers using login credentials assigned to a system account, exposing booking data. Japan Airlines (92,000 customers), Cathay Pacific (53,000 records incl. booking numbers, names, flight details, some passports and frequent flyer numbers), Singapore Airlines (46,000 records incl. confirmation numbers and itineraries), Korean Air, Asiana Airlines and Malaysia Airlines all reported breaches traced to Amadeus. Amadeus says no payment or financial data was accessed and no ransomware involvement; it has fixed the vulnerability and enhanced monitoring. Airlines' own systems were unaffected. Amadeus serves hundreds of airlines and airports, so further victim disclosures are possible.
What to do
- Identify any customer data exposed via Amadeus booking systems and notify affected customers per local regulations
- For airlines: rotate booking references/confirmation numbers for affected upcoming flights and warn customers about phishing emails referencing their bookings
- Review and rotate credentials and access controls for system accounts in Amadeus-integrated environments
- Verify Amadeus has applied the fix and confirm enhanced monitoring/detection is in place for your integrations
- Monitor for follow-on phishing, social engineering and booking-fraud attempts using leaked itineraries
Sources
All live incidents on Threat Watch
