Six Asian Airlines Confirm Data Breaches Tied to Amadeus Hack

Six major Asian airlines have disclosed data breaches over the past week, all traced to a single point of failure: Amadeus IT Group, the Spanish company whose software powers flight reservations, ticketing and check-in for airlines around the world.

Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have each come forward to say customer data was exposed through the breach. The numbers vary by carrier but add up fast: Japan Airlines said 92,000 customers had information stolen, Cathay Pacific reported 53,000 affected records, and Singapore Airlines put its number at 46,000.

The root cause, according to Amadeus, was a vulnerability in what the company described to Recorded Future News as a "travel booking display environment." In a statement, an Amadeus spokesperson said "certain booking-display data was accessible through the vulnerability," but added that the company has found no evidence that payment or financial data was accessed, and no indication the flaw was exploited for ransomware. Amadeus said it has since patched the vulnerability and added monitoring and detection capabilities, and that it's in direct contact with affected airlines and authorities.

What Amadeus hasn't said is just as notable. The company declined to tell Recorded Future News whether the attackers have made contact or how many total victims were affected across its entire customer base — a number that could run well beyond what the six airlines have reported individually, given Amadeus works with hundreds of airlines and airports globally.

What was actually taken

Cathay Pacific's disclosure gives the clearest picture of what's at stake. The airline said stolen records included booking numbers, passenger names and flight details, with some records also containing passport and travel document information, frequent flyer numbers and email addresses. Cathay said Amadeus told the airline that attackers used "login credentials assigned to its system account" to carry out the breach, though further detail on how those credentials were obtained wasn't provided.

Singapore Airlines, in comments to Reuters and Bloomberg, said the leaked data included confirmation numbers, travel itineraries and names. The airline said it would proactively contact passengers with upcoming flights to change their now-compromised booking numbers, and it warned customers to watch for suspicious emails that might try to exploit the leaked information.

Every one of the six airlines has emphasized that the breach stayed contained to Amadeus's systems and did not touch their own internal networks or flight operations. That distinction matters for travelers trying to gauge risk: this isn't a case where an airline's own security failed, but one where a shared vendor became the weak link for everyone who relies on it.

Why one vendor can take down six airlines at once

That's the real story here. Amadeus isn't a household name to most travelers, but it sits underneath an enormous slice of the global aviation industry — it reported more than $6.5 billion in revenue last year and maintains deals with hundreds of airlines and airports for reservation, ticketing and check-in technology. When a vulnerability shows up in a shared booking-display system, it doesn't just hit one carrier. It potentially hits every airline plugged into that system, which is exactly what played out here across six different countries' flagship carriers in the space of a week.

It's also part of a broader pattern. Aviation has become a favored target for cybercriminals over the past year, with dozens of airlines hit by attacks, according to the report. Recent incidents include breaches at Spanish carrier Iberia and Air Côte d'Ivoire in 2026. The starkest precedent is Qantas, which had 6 million customer records stolen last year — a breach serious enough that it ultimately led to fines against the Australian airline's senior executives.

The Amadeus incident fits that trend but with a twist: instead of attackers breaching an airline directly, they went after the infrastructure layer that multiple airlines depend on, getting far more mileage out of a single intrusion. For an industry that has consolidated heavily around a handful of IT providers for booking and reservations, that's a structural risk that individual airlines can't fully fix on their own, no matter how strong their own security is.

Amadeus says its investigation is ongoing, and it's not yet clear whether more airlines will come forward with their own disclosures in the weeks ahead. For now, passengers who've flown any of the six affected carriers recently should expect outreach about their booking details and treat unsolicited emails referencing flight confirmations with suspicion.