Amadeus Data Breach: Airlines Describe a Misused Login, Amadeus a Display Flaw

Cathay Pacific’s notice, published on 30 October, says an unauthorised party got into Amadeus’s reservation records using login credentials assigned to its system account. Amadeus, describing the same weeks to the German technology site heise online, said it had learned on 21 September of a potential vulnerability affecting a display environment for travel bookings. The two sentences sit in the same public record and describe different things: a login used by someone who should not have had it, and a flaw in the place bookings are shown. Nothing published since has said whether they are two descriptions of one incident, two incidents, or a flaw and the way through it, and no statement says whose login it was or how it was obtained.

Readers had pointed heise online to a memory dump from a Spring Boot application that could be reached through an endpoint needing no authentication, and heise reported what it found on 13 October. A memory dump is a snapshot of everything a running application held in memory, and this one held access credentials and authentication tokens, including administrator passwords that, heise reported, allowed read and write access to the global system. With the data heise could retrieve, a passenger could be searched by last name, and the records that came back included full names, dates of birth, booking references, contact details and ID and passport data in plain text, with details of bookings and travel updates. A large share concerned Lufthansa and Condor flights, alongside other airlines and partner airlines, and the dump also held hundreds of German travel-agency office IDs. Amadeus told heise the vulnerability was fixed and monitoring had been strengthened. The hole appeared closed at publication. Whether unauthorised people had used the opening, and how far, was still open when heise published, and the site said Germany’s Federal Office for Information Security had not answered its questions.

Korean Air heard first, on the evening of 20 October. Amadeus told the airline at 22:44 Korea time that there were signs personal information had leaked from its system, and Asiana was told five minutes later, according to the airlines’ accounts as reported in Korea. Both carriers disclosed the incident on 23 October, and Korean Air emailed affected customers that evening. Japan Airlines was told on 23 October and disclosed on 28 October. Cathay Pacific was told on 28 October, received further details the next day, and disclosed on 30 October. Malaysia Airlines published its statement on 31 October. Qantas spoke on 2 November. Thirteen days passed between the first notification, to Korean Air, and the Qantas statement.

Amadeus detected the unauthorised access on 24 September, ANA said, but ANA learned of it only after hearing on 16 October that other airlines using Amadeus had reported similar activity. ANA asked Amadeus to check its own data and received confirmation on 20 October, the same day Korean Air and Asiana were told. The count of about 37,800 customers was identified on 30 October. Twenty-six days passed between detection and the confirmation ANA received. ANA said the relevant credentials had been invalidated and monitoring had been strengthened, and that it would contact affected customers directly.

Japan Airlines and Japan Transocean Air put the number at about 92,000 customers. For about 90,000 of them, the records held a booking reference, a name, a flight date, a route and a class of service, and for about 2,000 more they also held email addresses, phone numbers, passport numbers, nationality and frequent-flyer numbers, with ticket and seat details. ANA put its number at about 37,800 customers, about 36,100 at the basic level and about 1,700 with passport numbers and contact details among the extended fields. The figures do not measure the same thing. Cathay counted bookings, not customers. Cathay Pacific counted about 53,000 bookings, and did not say how many of those bookings fell in the smaller subset carrying contact details, travel-document information or frequent-flyer numbers. Korean Air has confirmed only booking reference numbers so far, the six-character codes printed on itineraries, with other items still being checked with Amadeus. Malaysia Airlines gave no number and no list of fields. Adding the published figures together produces a number that counts customers and bookings as if they were the same unit, and it still leaves out every carrier that has published no figure. The passport numbers that were counted come to about 3,700 across the two Japanese carriers, and Cathay’s subset, uncounted, sits outside that total.

ANA told AIRDO, Solaseed Air and StarFlyer that their customers’ data in Amadeus-managed reservations showed signs of access, and the three smaller carriers do not run the Amadeus system themselves. AIRDO and Solaseed Air published notices on 30 and 29 October saying they were working with ANA to establish the impact, without giving totals or field lists. StarFlyer, in a notice first published on 29 October and updated the next day, named reservations made between 28 July 2025 and 23 September 2026. Its field list ran from names and booking references through email addresses, telephone numbers, frequent-flyer numbers, ticket numbers and seat numbers. No total was given. That window is the period of the reservations StarFlyer named, not a stated period of access, and the notice does not say every reservation in it was viewed.

Jin Air said it found abnormal external access to its own internal systems on 28 October, through an application programming interface used to look up member information, and disclosed the next day that information belonging to 1,454 members had leaked: user IDs, names, dates of birth, gender, nationality, mobile phone numbers, email addresses and the time of the most recent login. The low-cost carrier, in the same Hanjin Group as Korean Air and Asiana, does not belong in the Amadeus list, although several roundups have placed it there. Passwords, financial information and payment records were not included, the airline said, and it reported the incident to South Korea’s Personal Information Protection Commission, blocked the route of attack and deleted the system involved. Korean reporting on the notice is explicit that the route differs from the Amadeus reservation-system incidents at Korean Air and Asiana. Jin Air also started 24-hour emergency monitoring and a company-wide security review.

Qantas said on 2 November that Amadeus had advised it of unauthorised access to one of Amadeus’s systems. Amadeus had said the issue was contained in September, Qantas said, and Qantas was working with Amadeus to understand the impact on its bookings. Qantas said there was no impact to its own systems or databases, which remained secure, and the New Zealand Herald reported that Qantas had alerted Australia’s national cyber security offices. No number of customers, no list of data fields, no date on which Amadeus told Qantas, and no plan for contacting customers appeared in the material reviewed. Amadeus has published no list of the airlines whose records were accessed and no total number of passengers, and it did not answer Reuters’ question about how many customers’ data was affected.

In 2025 the airline detected unusual activity on a platform used by its contact centre, and Australia’s privacy commissioner later reported that about 5.12 million Australians had been affected by a social-engineering attack on an overseas third-party provider contracted by Qantas. The 2025 incident and the Amadeus incident are not the same event, and nothing in the Qantas statement links them. In both, Qantas said the provider’s system was the one accessed and its own systems were not.

“If you get an email from ANA / JAL / Cathay and find a strange link, don’t click it,” missbellisimo wrote on Threads on 30 October, in a post translated from Indonesian, adding: “The Amadeus booking system is being hacked badly. All passenger data, credit cards, passports leaked.” The credit-card claim runs further than any airline notice, which says there is no evidence financial information was accessed. wankimmy_ wrote on 31 October, in a post translated from Malay: “I didn’t click a link, I went straight to the Malaysia Airlines website.” The post then asked readers whether they opened the website or clicked the link. czarinaatienza wrote on 28 October: “Kinda glad i did the booking june 10, 2023, 2 months before this happened.” That date falls two months before the window the notices describe began. None of the three said an airline had written to them personally.

Hong Kong’s privacy office has started from Cathay’s notification. The Office of the Privacy Commissioner for Personal Data confirmed it had received Cathay Pacific’s breach notification and had begun an investigation under established procedures, and said it could not yet determine how many of the affected customers were Hong Kong residents. Korean Air and Asiana reported their incident to South Korea’s Personal Information Protection Commission. Cathay Pacific said it would notify affected customers individually once it had established the relevant details, and Japan Airlines said it would contact affected customers individually. The Hong Kong office said that, other than Cathay’s report, it had not received complaints or notifications from other airlines.