Five airline reports, one root cause: the breach at Amadeus, the reservation platform behind bookings at ANA, Cathay Pacific, Japan Airlines, Malaysia Airlines and Singapore Airlines.
Latest: Singapore Airlines: about 46,000 booking records accessed in the Amadeus breach, 620 may include travel document details (disclosed 2026-11-03)
Singapore Airlines said about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer numbers; its own systems were not breached — follow-up to our October 28 report.
Malaysia Airlines said customer information processed through Amadeus between August 2023 and September 2026 may have been affected in the Amadeus breach; it gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed.
All Nippon Airways said unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.
Cathay Pacific said the unauthorised access at Amadeus affected about 53,000 of its bookings from August 2023 to September 2026, covering booking references, passenger names and flight details, with contact details, travel document information and frequent flyer numbers in a smaller subset.
Japan Airlines and Japan Transocean Air said unauthorised access to Amadeus’s passenger service system left traces suggesting reservation data for about 92,000 customers may have been viewed, including contact details and passport numbers for about 2,000 customers.