One Supplier, Many Airlines: The Amadeus Booking Breach Keeps Growing

Most travelers have never heard of Amadeus, yet it sits behind the reservations, ticketing and check-in systems of a large share of the world’s airlines. Over the past two weeks, carrier after carrier has told customers that someone outside the company was reading reservation records inside that shared platform, in some cases for years.

This summary relies on Cathay Pacific’s customer notice, The Record’s report on the Japan Airlines disclosure and 7NEWS coverage of the Qantas response.

By the numbers

About 92,000: Japan Airlines and Japan Transocean Air customers affected. For roughly 2,000 of them, passport numbers, frequent flyer numbers, email addresses and phone numbers were also accessed.
About 53,000: Cathay Pacific bookings (bookings, not necessarily individual people) involved.
August 2023 to September 2026: the window during which Cathay says the unauthorized access occurred.
Zero: payment card numbers reported compromised by the airlines. Cathay says there is no evidence financial or payment information was accessed, and JAL says card numbers were not affected.

For most passengers, the exposed details are a booking reference, name and flight information. A smaller group also had contact details, travel document data or loyalty numbers in the affected records.

How the news traveled

September: according to Qantas, Amadeus told it the issue had been contained that month.
Last week: Amadeus notified Japan Airlines, which published its notice and said it would contact affected customers individually with reminders to watch for phishing emails, fraudulent calls and fake JAL websites.
October 28 and 29: Cathay Pacific received notice and then further details from Amadeus. It says its own systems and operations were not affected and that it has informed regulators.
This weekend: Qantas confirmed it had notified the Australian Cyber Security Centre and was working with Amadeus to understand the impact on its bookings, while saying its own systems were secure. Korean Air, Asiana and ANA have also been named among affected airlines, and 7NEWS reports that hotels and car rental companies were caught up as well.

What is still unclear

The descriptions do not fully line up. Cathay says Amadeus reported an unauthorized party using login credentials assigned to an Amadeus system account. A statement from Amadeus quoted by 7NEWS instead refers to a vulnerability in a travel booking display environment that made certain booking data accessible. Amadeus says it found no sign of ransomware, has fixed the issue, and has strengthened monitoring and detection; Cathay adds that passwords were reset. Amadeus has not published a full count of affected companies or travelers.

What this means for your company

Two lessons apply well beyond aviation. First, when you rely on a shared platform, your customers’ data is only as safe as that provider’s weakest account, and you may hear about a problem weeks after it was contained. Contracts should spell out how fast a supplier must notify you, and you should know which vendors hold which data. Second, the real danger from booking records is follow-up fraud: a scam email that quotes a genuine itinerary is very convincing. If your staff travel for work, remind them that a real airline will not ask them to “verify” payment through a link, and that they should go to the airline’s app or website directly.

Want a clear picture of which suppliers hold your company’s data, and how quickly they would tell you about a breach? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.