# Amadeus booking data breach: airlines notify affected passengers Canonical: https://www.oktsec.com/radar/amadeus-airline-booking-data-breach-2026 Publisher: Oktsec Language: en Published: 2026-11-04T19:33:00Z Updated: 2026-11-04T19:33:00Z Record reviewed: 2026-11-04T19:33:00Z Latest evidence check: 2026-11-04T19:33:00Z Disclosed: 2026-10-30 Amadeus and airline notices confirm unauthorized access to reservation data, including names, booking references and itineraries. Some subsets also include contact or passport details; the provider says it found no evidence of payment or financial data access. ## Evidence and response priority - Category: Data breach - Oktsec priority: Review this week - Rationale: Airlines confirm passenger data exposure and are contacting affected customers. Review the carrier’s scope and response instructions this week; escalate suspected misuse immediately. Provider containment does not remove the risk from information already accessed. - Evidence: Incident confirmed by provider - Verification: Vendor confirmed - Fix status: Not applicable - Exposure requirement: Application or configuration dependent - Vendor: Amadeus - Products: Amadeus booking records ## Technical overview Amadeus confirms a vulnerability in a travel booking display environment. It says corrections and additional monitoring are in place, with no evidence of payment or financial data access and no indication of ransomware exploitation. Its investigation continues; the public statement does not identify a CVE or provide a complete technical account. JAL and Japan Transocean Air report about 92,000 affected customers: names, reservation codes and travel details, with approximately 2,000 also involving additional fields such as passport and contact information. Their October 30 notice says flight operations are unaffected. ANA identifies about 37,800 customers who made reservations between August 10, 2023 and September 23, 2026. Around 1,700 potentially had additional contact, passport and loyalty information accessed. ANA says credit card numbers and account passwords were not involved. Cathay Pacific reports about 53,000 bookings, mostly involving names, booking references and flight details; a smaller subset potentially included additional personal information. It describes access using credentials assigned to an Amadeus system account and says Cathay’s systems and operations were unaffected. According to CNA’s November 3 report of Singapore Airlines’ statement, about 46,000 booking records were accessed, with roughly 620 potentially including additional contact, travel document or loyalty details. The airline is contacting affected customers with upcoming travel to change booking references. These counts mix customers and bookings; they cannot be added into a unique passenger total. Data fields and date definitions also differ by airline. The notices do not establish that every Amadeus customer or traveler was affected. Oktsec recommends checking the carrier’s notice and verifying unexpected travel messages independently. Exposed itineraries can make impersonation more convincing. This is a precaution against potential misuse, not a finding that every affected passenger has received a fraudulent message. ## Recommended response Check your airline’s notice and affected bookings. Verify unexpected travel messages through official channels and follow any instructions to replace booking references. Relevant to: Passengers, corporate travel managers and security teams with bookings covered by an airline’s incident notice. ## Response checklist 1. **Confirm affected bookings and data fields** — Use the airline’s official notice and customer support to identify the affected booking references and exposed fields. Corporate travel teams should coordinate this check with their travel provider. An Amadeus connection alone does not establish exposure, and older reservations can be in scope. 2. **Follow the airline’s reservation instructions** — For upcoming travel, confirm whether your airline requires a new booking reference. CNA reports that Singapore Airlines is contacting affected travelers for this purpose. Apply instructions specific to your carrier; this is not a universal request to replace passports or cancel flights. 3. **Verify unexpected travel and payment requests** — Treat accurate names, flight details or reservation codes in a message as insufficient proof of identity. Open the airline’s official app or website independently and verify unexpected payment, refund or itinerary requests. Preserve suspicious messages and report them to the airline and your security team. 4. **Track notices and respond to signs of misuse** — Record the airline’s findings, notification date and any changes to the exposure scope. If passport or loyalty details are identified in your notice, follow the issuer’s or airline’s guidance for that information. Escalate evidence of misuse promptly; provider containment cannot retract data already accessed. ## Relevance to AI environments The disclosures do not establish AI involvement. For travel assistants handling reservation data, Oktsec recommends limiting access to necessary records and verifying unexpected payment or itinerary change requests through an established airline channel. ## Sources - [Amadeus statement on the booking display vulnerability](https://amadeus.com/en/industry-messaging/amadeus-statement-oct) — Amadeus; Vendor notice; checked 2026-11-04T19:33:00Z - [JAL and Japan Transocean Air: customer scope and response](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) — Japan Airlines; Vendor notice; checked 2026-11-04T19:33:00Z - [ANA: unauthorized access to passenger reservation data](https://www.ana.co.jp/en/us/special-notice/001615.html?p1=top&p2=en&p3=global) — ANA; Vendor notice; checked 2026-11-04T19:33:00Z - [Cathay Pacific: reservation data incident at Amadeus](https://www.cathaypacific.com/cx/it_IT/latest-news/security-and-operational-changes/personal-data-security.html) — Cathay Pacific; Vendor notice; checked 2026-11-04T19:33:00Z - [CNA reports Singapore Airlines’ November 3 statement](https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151) — CNA; Media report; checked 2026-11-04T19:33:00Z - [EFE: Asian airlines affected by the Amadeus data breach](https://efe.com/economia/2026-11-04/reservas-aerolineas-asia-afectadas-brecha-seguridad-amadeus/) — EFE; Media report; checked 2026-11-04T19:33:00Z ## Editorial record - 2026-11-04T19:33:00Z: Added confirmed reservation data exposure, separate airline counts and passenger response guidance. Singapore Airlines figures are attributed to CNA’s report of its statement. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/amadeus-airline-booking-data-breach-2026) · [Build a response plan](https://www.oktsec.com/radar/amadeus-airline-booking-data-breach-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=amadeus-airline-booking-data-breach-2026&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.