Airlines Affected as Global Amadeus Booking System Breached

Global Amadeus Cyber Breach Affects Qantas and International Airlines

Global travel technology provider Amadeus suffered an unauthorized access breach between August 2023 and September 2026, impacting passenger reservations and booking information across multiple international carriers, including Qantas and Cathay Pacific, NZ Herald reported. The incident involved external agents gaining entry to one of the Spanish technology company’s systems, prompting airlines worldwide to audit their supply chain security and passenger data protections.

Airlines Confirm Impact and Secure Systems

Qantas confirmed the cyber incident after receiving notification from Amadeus, stating that the company’s internal systems and databases remained secure and unaffected. A Qantas spokesperson noted that the carrier is actively working with Amadeus to determine the exact volume and nature of any compromised passenger bookings. Cathay Pacific reported that approximately 53,000 of its customer bookings experienced unauthorized access during the breach window. Malaysia Airlines also acknowledged that some customer information may have been compromised, according to Reuters coverage cited by NZ Herald. Meanwhile, Air New Zealand issued a public statement clarifying that it does not believe its operations were impacted by the security event. Logon Software Asia Group reported on LinkedIn that regional carriers Korean Air and Asiana explicitly verified that their internal networks showed no signs of compromise.

Containment Actions and Payment Data Security

Amadeus contained the security incident in September, implementing password resets and deploying enhanced monitoring and detection capabilities across its infrastructure. Cathay Pacific confirmed that Amadeus has not uncovered any evidence indicating that the affected passenger data has been misused since the unauthorized access occurred. Qantas stated that preliminary findings from Amadeus show no evidence that payment records or financial transaction data were accessed during the breach. Following the incident, Qantas notified both the Australian Cyber Security Centre and the Office of National Cyber Security.

Supply Chain Security Questions for International Aviation

The Amadeus incident exposed vulnerabilities in the aviation technology supply chain, raising critical operational questions for airline executives. Logon Software Asia Group highlighted concerns regarding data custody, asking whether airlines maintain clear oversight of third-party data holders, their authentication protocols, and the justification of ongoing vendor access. Amadeus IT Group provides core technological infrastructure—including artificial intelligence and biometric systems—for more than 400 airlines globally, making third-party security audits a central focus for the industry moving forward.

Airline Passenger Data Security FAQ

Which airlines are confirmed to be impacted by the Amadeus breach?

Qantas, Cathay Pacific, and Malaysia Airlines confirmed that they were impacted by the unauthorized access to the Amadeus system. Cathay Pacific specified that about 53,000 of its bookings were affected.

Were financial records or payment details exposed during the incident?

Amadeus reported to client airlines that there is no evidence indicating payment records or financial transaction data were accessed by the unauthorized agent.

When did the unauthorized access occur and when was it contained?

The unauthorized access took place between August 2023 and September 2026. Amadeus contained the security issue in September.

Which government agencies were notified about the breach?

Qantas notified the Australian Cyber Security Centre and the Office of National Cyber Security regarding the incident and its ongoing investigation.