# Amadeus access exposed 92,000 JAL customers and 53,000 Cathay bookings

_Oct 31 12:25_

Tags: Cathay Pacific, JAL, ANA, other, airline, other relevant news

Type: Incident

## Summary

Unauthorized access to Amadeus reservation systems lasted from 10 August 2023 to 23 September 2026 and exposed passenger booking data at several Asian airlines. The access used login credentials for a system account. Airlines say their own systems were not compromised. Amadeus has not identified evidence that the data was misused and has not issued a public press release.

Cathay Pacific was told on 28 October 2026 that about 53,000 of its bookings were in the accessed data, usually the booking reference and itinerary. A smaller Cathay subset may also have had emails or frequent flyer numbers exposed. Japan Airlines and Japan Transocean Air counted about 92,000 affected customers, including about 2,000 whose passport or frequent flyer number was accessed. Malaysia Airlines said it has seen no sign financial data was taken. Korean Air and Asiana were also named, as was ANA.

Carriers have started emailing affected customers. Frequent flyer numbers in the accessed records can be used for targeted phishing against people who flew those airlines between August 2023 and September 2026. Watch airline notification emails and treat unexpected requests for account or payment details as suspicious.

## Key facts

- **Announced**: Oct 30, 2026
- **Starts**: Aug 10, 2023
- **Ends**: Sep 23, 2026
- **Numbers**:
  - 53,000 bookings: Cathay Pacific bookings in the accessed Amadeus data
  - 90,000 customers: JAL Group customers whose PNR, name and flight details showed traces of access
  - 2,000 customers: JAL Group customers with extra personal fields accessed
  - 92,000 customers: total Japan Airlines and Japan Transocean Air customers affected
- **Who qualifies**: Customers whose Amadeus-processed reservations with affected airlines fell between August 2023 and September 2026
- **Links**:
  - Announcement: [Malaysia Airlines cybersecurity incident notice](https://www.malaysiaairlines.com/my/en/mh-media-centre/important-for-you/cybersecurity-incident-third-party-technology-provider.html)
  - Announcement: [Cathay Pacific personal data security incident notice](https://www.cathaypacific.com/cx/en_HK/latest-news/security-and-operational-changes/personal-data-security.html)
  - Announcement: [Japan Airlines unauthorized access announcement](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html)
- **Takeaway**: Watch for airline notification emails, treat unexpected messages asking for account or payment details as suspicious, and review frequent flyer accounts if you flew those carriers during the incident window.

## Sources cited

- [LoyaltyLobby](https://loyaltylobby.com/2026/10/31/massive-amadeus-hack-affecting-hundreds-of-thousands-of-passengers-across-multiple-airlines?omhide=true) — Massive Amadeus Hack Affecting Hundreds Of Thousands Of Passengers Across Multiple Airlines

## Related signals

- [Asia Miles restores Japan Airlines awards after this month's outage](https://thetravelsignal.com/s/cathay-pacific-brings-back-jal-awards-using-asia-miles.md)
- [Cathay suspends Asia Miles awards on Japan Airlines](https://thetravelsignal.com/s/cathay-pacific-asia-miles-suspends-japan-airlines-awards.md)
- [ASMALLWORLD Prestige includes 250,000 Asia Miles for $3,940 to Nov 3](https://thetravelsignal.com/s/last-call-cathay-pacific-250-000-asia-miles-extras-for-3-940-until-november-3-20.md)
- [Citi adds 10% to ThankYou transfers to Asia Miles to Nov 14](https://thetravelsignal.com/s/transfer-citi-thankyou-points-to-cathay-with-a-10-transfer-bonus.md)
- [ASMALLWORLD Prestige sale: 250,000 Asia Miles for $3,940 to Nov 3](https://thetravelsignal.com/s/cathay-pacific-250-000-asia-miles-extras-for-3-940-until-november-3-2026.md)

Older: [United will fly Las Vegas to Tokyo Narita on Polaris Studios 787-9](https://thetravelsignal.com/s/united-is-bringing-its-nicest-plane-with-the-polaris-studios-to-a-city-that-neve.md)
Newer: [Accor 2X Reward points on APAC, Middle East, Africa stays to March 31](https://thetravelsignal.com/s/all-accor-double-points-for-stays-at-select-brands-in-asia-pacific-middle-east-a.md)

Canonical URL: https://thetravelsignal.com/s/massive-amadeus-hack-affecting-hundreds-of-thousands-of-passengers-across-multip