Singapore: Singapore Airlines (SIA) has become the latest major carrier to disclose that customer reservation information was accessed in a cybersecurity incident involving global travel technology provider Amadeus IT Group, with approximately 46,000 booking records affected. The airline disclosed the incident on 3 November 2026, saying the exposed information included passengers’ names, booking reference numbers, travel itineraries and booking classes. For approximately 620 booking records, additional information, including email addresses, telephone numbers, travel document details and KrisFlyer membership numbers, may also have been accessed.
In a statement, SIA said the incident was confined to Amadeus’ platform and did not involve a breach of its own IT systems. The airline added that Amadeus had implemented containment measures and additional security safeguards. It also confirmed that bank account and credit card information had not been exposed and that no bookings had been modified. As a precaution, SIA is contacting affected customers with upcoming travel to change their booking reference numbers. The airline said: “The protection of our customers’ personal data is of utmost importance to SIA.”
Cathay Pacific Airways disclosed its exposure on 30 October 2026, reporting approximately 53,000 affected bookings. In its official notice, the airline said it had received notification from Amadeus on 28 October and further information on 29 October. The unauthorised access involved login credentials assigned to an Amadeus system account and affected reservation information held between August 2023 and September 2026. In most cases, the accessed information included booking references, passenger names and flight details. A smaller number of records may also have contained email addresses, telephone numbers, travel document information and frequent-flyer numbers.
Cathay Pacific stated that “there is no evidence that financial or payment information was accessed.” The airline further confirmed that Amadeus had reset the relevant password and strengthened its monitoring and detection capabilities. It said there was no evidence that the accessed information had been misused and that the incident had not affected its own systems or operations.
Japan Airlines (JAL) and Japan Transocean Air (JTA) were informed by Amadeus on 23 October 2026 about unauthorized access to part of their customer reservation information. In its notice published on 30 October, JAL Group disclosed that approximately 92,000 customers were affected across the two airlines. Of these, approximately 90,000 customers had their reservation codes, names, flight dates, flight sectors and service classes potentially accessed. For another approximately 2,000 customers, additional information, including email addresses, telephone numbers, passport numbers, nationalities, frequent-flyer numbers, airline and flight numbers, ticket numbers and seat numbers, may also have been accessed.
JAL stated that “there has been no compromise of credit card numbers or any passwords.” The airline added that Amadeus had completed the necessary security measures, no evidence of misuse had been identified and the incident had not affected flight operations. The period during which traces of external access were identified was 10 August 2023 to 23 September 2026. JAL also confirmed that affected customers were being contacted through their registered email addresses.
All Nippon Airways (ANA) disclosed the incident on 29 October and released further details on 30 October 2026, reporting approximately 37,800 customers whose reservation information may have been accessed. The affected reservations were made between 10 August 2023 and 23 September 2026. According to the airline’s official disclosure, approximately 36,100 customers had their names, booking references, travel dates, flight routes and cabin classes potentially accessed. For approximately 1,700 customers, additional information, including email addresses, telephone numbers, passport numbers, nationalities, frequent-flyer numbers, airline and flight numbers, e-ticket numbers and seat numbers, may also have been accessed.
ANA confirmed that credit card information and account passwords were not involved. It said the authentication credentials associated with the incident had been revoked and monitoring protocols strengthened. The airline also said it would contact affected customers directly. Its official notice did not specify the date on which it first received notification from Amadeus.
Several Japanese regional carriers subsequently disclosed potential exposure through the Amadeus reservation system accessed via ANA. Star Flyer published its first notice on 29 October, updated on 30 October 2026, confirming that it had received information from ANA indicating that reservation details for Star Flyer-operated flights had been accessed by an unauthorised third party. The airline identified affected reservations made between 28 July 2025 and 23 September 2026. The information potentially accessed included customer names, booking references, travel dates, flight routes, cabin classes, email addresses, telephone numbers, frequent-flyer numbers, airline and flight numbers, e-ticket numbers and seat numbers. Star Flyer said it was still verifying the number of affected individuals and would provide an update once confirmed. It also stated that credit card information and account passwords were not involved.
AIRDO, in a notice dated 30 October 2026, also confirmed receiving information from ANA that traces of unauthorised access to some of its customers’ personal information had been found in reservation data managed by Amadeus. The airline said it was working closely with ANA to determine the extent of the impact and would provide further details once confirmed. It did not disclose an affected customer count or the specific information accessed.
Solaseed Air published its notice on 29 October 2026, stating that ANA had informed it of indications that personal information contained in reservations managed by Amadeus had been accessed by an unauthorised third party. The airline said it was coordinating with ANA to identify the extent of the exposure and would publish further information when available. No affected customer figures or specific data categories were disclosed in its initial notice.
South Korean carriers Korean Air and Asiana Airlines were among the first airlines to publicly disclose the incident. Both airlines received official notification from Amadeus on 20 October 2026. Korean Air said it received the notification at 10:44 p.m. local time, while Asiana Airlines received it five minutes later, at 10:49 p.m. Both airlines published customer notices dated 23 October 2026.
Korean Air confirmed that some customers’ reservation numbers had been exposed through unauthorized access to Amadeus’ systems. The airline said the incident was believed to have occurred between August 2023 and September 2026, although the exact timing remained under investigation. It confirmed that the incident involved login credentials assigned to an Amadeus system account and that there were no indications of a breach of Korean Air’s own database. The airline did not disclose the number of affected customers or any additional compromised data categories.
In its official notice, Korean Air said, “We officially received notification from Amadeus at 10:44 p.m. on October 20, 2026, and became aware of this incident.” It added that it had reported the incident to South Korea’s Personal Information Protection Commission and taken the necessary security measures. The airline also said that no secondary damage had been identified at the time of its notice and that it had asked Amadeus to strengthen protective measures and introduce steps to prevent a recurrence.
Asiana Airlines separately confirmed that some customers’ reservation numbers had been exposed through the same Amadeus incident. Its official notice, published on 23 October 2026, stated that the airline had received formal notification from Amadeus at 10:49 p.m. on 20 October. Asiana said the incident was believed to have occurred between August 2023 and September 2026 and involved unauthorized access using login credentials assigned to an Amadeus system account.
The airline confirmed that its own internal database had not been compromised and that it had reported the incident to South Korea’s Personal Information Protection Commission. It said the other potentially exposed information was still being investigated and that customers identified as affected had been notified by email. Asiana also stated that no cases of secondary damage had been identified at the time of its announcement. The airline did not publish a figure for the number of affected customers.
Malaysia Airlines issued a separate customer advisory on 31 October 2026, warning that some customer information processed through Amadeus between August 2023 and September 2026 may have been affected. However, the airline did not confirm the number of affected bookings or customers, nor did it identify the specific personal information potentially accessed.
The airline stated that its own IT systems had not been compromised and that there was no evidence that financial information had been accessed. It said it was working with Amadeus and relevant parties to investigate the incident and assess its impact. Malaysia Airlines should therefore be described as a carrier investigating potential exposure, rather than one with a publicly quantified impact.
Amadeus acknowledged the vulnerability in an October 2026 statement, saying it had become aware of an issue affecting a travel booking display environment through which certain booking-display data was accessible. The company said its investigations were continuing and that it had implemented measures to fix the vulnerability, alongside enhanced monitoring and detection capabilities.
Amadeus stated that “there is no evidence that payment or financial data was accessed.” It also said there were no indications that the vulnerability had been exploited for ransomware purposes and confirmed that it was in direct communication with its airline customers and relevant authorities. The company did not publish a consolidated figure for the number of airlines or passengers affected.
