Amadeus access exposed 92,000 JAL customers and 53,000 Cathay bookings

Unauthorized access to Amadeus reservation systems lasted from 10 August 2023 to 23 September 2026 and exposed passenger booking data at several Asian airlines. The access used login credentials for a system account. Airlines say their own systems were not compromised. Amadeus has not identified evidence that the data was misused and has not issued a public press release.

Cathay Pacific was told on 28 October 2026 that about 53,000 of its bookings were in the accessed data, usually the booking reference and itinerary. A smaller Cathay subset may also have had emails or frequent flyer numbers exposed. Japan Airlines and Japan Transocean Air counted about 92,000 affected customers, including about 2,000 whose passport or frequent flyer number was accessed. Malaysia Airlines said it has seen no sign financial data was taken. Korean Air and Asiana were also named, as was ANA.

Carriers have started emailing affected customers. Frequent flyer numbers in the accessed records can be used for targeted phishing against people who flew those airlines between August 2023 and September 2026. Watch airline notification emails and treat unexpected requests for account or payment details as suspicious.