Amadeus Breach Exposes Airline Booking Data for 37 Months, Malaysia Airlines Warns of Fake Messages

Amadeus disclosed that a security lapse allowed outside access to passenger booking records via stolen administrative credentials. The exposure lasted from August 2023 until the flaw was fixed in September 2026, spanning about 37 months.

Malaysia Airlines stated that its own network was not breached, but passenger booking records used by Amadeus were exposed. The incident involved access to reservation screens through the travel-software provider’s system.

Japan Airlines reported that about 92,000 customers were affected, including passport numbers. Cathay Pacific indicated 53,000 affected customers, and All Nippon Airways reported 37,800 affected customers.

Korean Air and Asiana confirmed that reservation numbers were exposed, but they had not determined the full scale more than ten days after notification. Amadeus noted that payment data was kept separate, with credentials rotated and additional monitoring put in place.

Travel carriers began warning travelers about fake refund and itinerary messages that reference real flight details in connection with the breach.