Amadeus breach exposes 53,000 Cathay Pacific bookings and 92,000 JAL customer records

Quick summary

Credentials assigned to a system account at travel-technology vendor Amadeus IT Group were used to reach airline reservation records between August 2023 and September 2026, exposing roughly 53,000 Cathay Pacific bookings plus data belonging to about 92,000 JAL Group customers, 37,800 ANA passengers and 1,454 Jin Air passengers. No payment information was accessed and no flights were disrupted.

Korean Air and Asiana Airlines have not published affected-customer counts. The exposure is a booking-data problem, which means loyalty accounts and booking references are what passengers should watch.

The weak point was not an airline’s firewall. It was one login.

An unauthorised party used credentials assigned to a system account at Amadeus IT Group — the reservation and ticketing platform sitting behind a large share of Asia-Pacific carrier bookings — to reach passenger reservation records across a window spanning roughly three years. Cathay Pacific confirmed about 53,000 of its bookings were caught up in it. Japan Airlines and Japan Transocean Air together account for some 92,000 affected customers, ANA reported 37,800, and Jin Air put its figure at 1,454.

Nothing about your flight changes. Cathay said its own systems and operations were unaffected, and no carrier has reported schedule or booking disruption. What changes is what you should do with your inbox and your frequent flyer account.

Scope runs through Hong Kong, Japan and South Korea — the carriers Western travellers use most on transpacific and intra-Asia itineraries. Condor, a German airline, has been reported as affected by an outside outlet, but that claim is not independently confirmed. The access window closed in September 2026; the public disclosures landed in late October.

What the Amadeus breach actually exposed

Amadeus told Cathay Pacific on October 28, 2026 and supplied more detail the next day; the airline went public on October 30. Asiana Airlines was notified earlier, on October 20, and posted its customer alert on October 23 — the same day as Korean Air. That staggered calendar is the clearest evidence of how the incident worked: each carrier had to assess the same vendor-held environment on its own timetable.

What was reached varies by record. Booking references, passenger names and flight details appear in the majority of affected cases. A smaller subset may also have included email addresses, phone numbers, travel document details or frequent flyer numbers. Cathay’s official notice states payment information was not accessed.

That distinction matters more than it sounds. A stolen card number can be cancelled in a single phone call. A booking reference paired with a passport number and a loyalty balance is a different asset — enough to impersonate a traveller convincingly, and enough to attempt an account takeover on a programme where points can be transferred out.

Amadeus said it reset the compromised password and added enhanced monitoring and detection. Asiana‘s customer notice confirms the airline’s own databases were not breached and that South Korean authorities were informed.

For travellers holding transpacific bookings — flights from North America to Japan, for example — the practical consequence is administrative rather than operational.

Why one vendor’s breach reached six airlines at once

Carriers do not each build their own reservation engine. Most rent capacity inside a shared platform, and a system account credential opens whichever tenant records sit behind it. That is why a single credential failure surfaced simultaneously in Hong Kong, Japan and South Korea — and why the airlines learned about it from their vendor rather than from their own security teams.

Vendors notify carriers in batches, and carriers notify passengers in batches after that. The ten-day gap between Asiana’s October 20 notification and Cathay’s October 30 disclosure is not sloppiness; it is the standard sequence of a supply-chain disclosure, where each airline has to work out independently which of its own records sat in someone else’s system.

The playbook from here is predictable. Password resets and monitoring come first, then individual notification letters, then identity-monitoring offers where a carrier decides the exposure warrants it, and finally a regulator filing that quantifies records. Watch which carriers reach the last step — that is where the real numbers surface.

Securing your booking and loyalty accounts

If you have flown any of these carriers since 2023, your record may sit in the exposed set — and the airlines are notifying passengers at different speeds, so waiting for an email is not a plan.

1. Log in directly, not through a link. Open the airline’s own website or app and sign in there. Any message that quotes your booking reference and asks you to click is the exact shape of a follow-on phishing attempt.
2. Change the loyalty password. Do this for Cathay, JAL, ANA, Korean Air, Asiana and Jin Air accounts you hold, and use a password you have not reused elsewhere.
3. Check your points balance and redemption history. Unrecognised transfers or redemptions are the fastest signal that a frequent flyer number has been used.
4. Verify any contact through official channels. If someone calls about your itinerary or passport details, hang up and ring the airline’s published customer-service number.

Watch: whether Korean Air and Asiana publish affected-customer counts, and whether Hong Kong, Japanese or South Korean data-protection regulators open formal inquiries — those filings are where aggregate figures usually appear.

Questions? Answers.