Six Asian airlines report passenger data breaches traced to booking technology provider Amadeus

Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have reported data breaches in the past week, all traced to the Spanish travel technology provider Amadeus IT Group. Amadeus said it recently learned of a vulnerability affecting a travel booking display environment and that certain booking display data was accessible through it.

Japan Airlines said about 92,000 customers had information stolen, Singapore Airlines said 46,000 records were accessed, including names, confirmation numbers and itineraries, and Cathay Pacific said data from 53,000 bookings was taken, some of it with passport and travel document information, frequent flyer numbers and email addresses. Cathay Pacific said Amadeus told it the attackers used login credentials assigned to its system account. Amadeus said there was no evidence that payment or financial data was accessed and no indication of ransomware, and that it had fixed the issue and improved monitoring. It declined to say how many people were affected.

Privacy teams at organisations that rely on shared booking or reservation platforms should check that processor contracts set clear breach notification timelines and that supplier system accounts are covered by access reviews. They should also confirm whether passenger data exposed through a supplier platform triggers their own regulatory notification duties, ask suppliers for written confirmation of the fix, and prepare affected travellers for follow-up phishing.

Amadeus works with hundreds of airlines and airports, and the incident follows other recent attacks on carriers including Iberia, Air Côte d'Ivoire and Qantas.