Amadeus (airline reservation systems: JAL, Cathay Pacific, Korean Air, Asiana and others) data breach

What happened

Amadeus, the Spanish company that runs reservation, ticketing and check-in systems for hundreds of airlines, said it became aware of a vulnerability in a travel booking display environment through which certain booking data was accessible; it says there is no evidence payment or financial data was accessed. Airlines say an unauthorized party used login credentials assigned to an Amadeus system account between August 2023 and September 2026. Asiana and Korean Air disclosed the breach first, and Japan Airlines said about 92,000 customers were affected, about 2,000 of whom also had email addresses, phone numbers, passport numbers, nationalities and frequent flyer numbers exposed. Cathay Pacific said around 53,000 bookings were affected, Singapore Airlines said 46,000 records were accessed, and Malaysia Airlines and ANA also warned customers. Most records contain booking references, passenger names and flight details; Amadeus has not said how many people in total were affected.

What should I do?

1. Be wary of calls, emails or texts that quote your booking reference or flight and offer refunds, rebooking or compensation; contact the airline through its official website or app instead.
2. Don't give card details, passwords or one-time codes to anyone who contacts you about a booking.
3. If your airline says your passport number was exposed, watch for identity scams using it, and ask the airline what it recommends.
4. Change your frequent flyer account password if you reuse it elsewhere, and check the account for unexpected activity.

Check the other services you use →