Amadeus, the Spain-based company whose passenger service system handles reservations, ticketing and check-in for many airlines, has told carriers that an outsider had access to travel reservation data on its systems for more than three years. According to Japan Airlines, the unauthorised access ran from 10 August 2023 to 23 September 2026. Amadeus told Cathay Pacific that an unauthorised party used login credentials assigned to a system account; Amadeus says it has reset the password, strengthened monitoring and detection, and found no evidence that the data has been misused.
Airlines that have disclosed so far:
- Japan Airlines (with Japan Transocean Air): about 92,000 customers. For about 90,000, the data was reservation (PNR) codes, names, flight dates, routes and travel class. For about 2,000 more, it also included email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers and flight, ticket and seat numbers. JAL says card numbers and passwords were not exposed.
- ANA: about 37,800 customers who booked ANA-operated flights in the same period — names, reservation numbers, travel dates and flight segments; passport numbers and nationality for about 1,700 of them. ANA says no card details or passwords were exposed.
- Cathay Pacific: about 53,000 bookings, mostly booking references, names and flight details; a smaller, unquantified group may also include contact details, travel document numbers and frequent flyer numbers. Cathay says there is no evidence that payment data was accessed and it will contact affected customers individually.
- Korean Air and Asiana Airlines have confirmed they are affected but have not given numbers; Paddle Your Own Kanoo also names Germany's Condor.
The total is not known. The airlines count differently (customers vs bookings), so their figures should not simply be added up. Amadeus's Altéa platform has more than 130 airline customers, so more disclosures are possible.
How the attacker got the account login is not confirmed. Paddle Your Own Kanoo suggests the password reset points to social engineering, such as tricking a help desk into handing over credentials, but this is the outlet's inference, not a finding by Amadeus. Itineraries plus names and email addresses are useful for convincing phishing, which is the main near-term risk for passengers.
