Unauthorized access through Amadeus credentials exposed booking data at six airlines

An unauthorized party used Amadeus system account credentials to access airline booking data from August 2023 to September 2026, a span of more than three years, exposing records at Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air, Asiana Airlines and Star Flyer.

The Japan Airlines group said about 92,000 customers were affected, while Cathay Pacific said roughly 53,000 bookings were exposed over the same period. Cathay said it found no evidence that financial or payment information was accessed. The carriers said flight operations were not affected, and no customer information misuse has been found.

For Japan Airlines, the exposed records included names, booking references, flight dates, routes and travel classes for roughly 90,000 customers. Amadeus notified Japan Airlines on Oct. 23, 2026.

Amadeus notified Korean Air on Oct. 20, 2026, the airline said, and booking reference numbers for some customers were exposed through the Amadeus account. Both South Korean carriers confirmed exposure through the vendor account. The carrier said its internal systems showed no signs of compromise. It told South Korea’s Personal Information Protection Commission about the incident, notified affected customers by e-mail, and asked Amadeus to strengthen safeguards and put measures in place to prevent recurrence.

The company said it became aware of a possible flaw in a travel booking display environment on Sept. 21, 2026, and published a statement about it on Oct. 1, 2026. It said no payment data was involved and no ransomware was indicated, and it fixed the problem while improving monitoring. BleepingComputer sought scope details from Amadeus, but the company had not provided more as of publication.

According to German media coverage, security researchers found an unauthenticated endpoint that exposed memory dumps containing access credentials and authentication tokens. A heap dump is a memory snapshot. Those administrator passwords allowed reading and writing across the global system. Visible data sets included full names, dates of birth, booking codes, contact details, ID information and passport details without encryption.

A large part of the checked data concerned flights from Lufthansa and Condor.

More than 400 airlines worldwide use Amadeus passenger service and reservation systems, and the company also serves 210 airport operators, 34 cruise and ferry lines and 2 million hotels. Amadeus reported sales of around 6.5 billion euros for 2025. Amadeus is a central vendor in global airline reservation infrastructure.

South Korea’s Personal Information Protection Act requires a data controller to supervise contractors under Article 26, including training and reviews of how personal information is handled. It has not been established that Korean Air violated that duty in this case. Investigators have not linked this incident to a separate hack of catering partner KC&D Service in December last year that exposed employee information for roughly 30,000 people.

Hwang Seok jin said booking references can provide clues about travel plans. He is a professor at Dongguk University. He said, “This was not a breach of the airline’s internal network but of an external network.”

Domestic booking data for Asiana will move in stages on Nov. 2, Nov. 9 and Nov. 16. International records will move gradually from Nov. 4 through Dec. 3. From Dec. 17, Asiana flights departing on or after that date will carry Korean Air flight numbers. The data being transferred includes names, contact information, booking references, passport numbers and credit card numbers.

All Nippon Airways halted certain website and app services on Oct. 21 because of the separate PHP2Shell threat, not the Amadeus incident. Korean Air said it runs groupwide continuous security monitoring and plans stronger inspections of external contractors. Its information security spending reached 13.9 billion won in 2025, compared with 8.2 billion won in 2023, and stood at 10.5 billion won in 2024. The airline disclosed rising information security investment in its ESG reporting.

The airline said no follow-on harm has been confirmed. Other categories of potentially exposed information remain under investigation along with the total number of affected customers. Korean Air told customers to be wary of links and attachments from unclear sources and said affected customers can pursue compensation or dispute mediation.