More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus

Multiple airlines in Asia are reporting data breaches after a cyberattack on a Spanish IT provider exposed customer details. 

Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward over the last week to report data breaches traced back to Amadeus IT Group — a company that builds and maintains platforms for flight reservation, ticketing and check-in platforms. 

A spokesperson for Amadeus told Recorded Future News that it recently became aware of a vulnerability affecting a travel booking display environment. 

“Certain booking-display data was accessible through the vulnerability. Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed,” the spokesperson said. “There are no indications that this vulnerability has been exploited for ransomware purposes. Amadeus implemented measures to fix the vulnerability as well as enhanced monitoring and detection capabilities. We are in direct dialogue with our customers and authorities.”

The company declined to say whether the attackers have contacted them or how many total victims were impacted by the attack. 

Japan Airlines said 92,000 customers had information stolen and Singapore Airlines said 46,000 records were accessed. Cathay Pacific said 53,000 records were stolen by the hackers, including booking numbers, passenger names and flight details. Some records included passports and other travel documents as well as frequent flyer numbers and email addresses.  

The company said they were told by Amadeus that the threat actors used “login credentials assigned to its system account” during the breach but did not explain the incident further. Singapore Airlines told Reuters and Bloomberg that confirmation numbers, travel itineraries and names were leaked as part of the incident. 

Singapore Airlines said it would contact people with upcoming flights to change their now-exposed booking numbers and urged customers to be wary of malicious emails. 

All the airlines said the cyberattack on Amadeus did not impact their own systems or operations. 

Amadeus reported more than $6.5 billion in revenue last year and has deals with hundreds of airlines and airports for IT services and technology platforms for ticketing and reservations. 

Dozens of airlines have been attacked by cybercriminals over the last year, including incidents in 2026 involving Spanish airline Iberia and Air Côte d'Ivoire. Hacker stole 6 million customer records last year from Australian airline Qantas in an incident that eventually led to the company’s senior executives being fined hundreds of thousands of dollars.