Malaysia Airlines: customer information may have been affected in the Amadeus breach
Malaysia Airlines said on November 1, 2026 that customer information processed through its reservation provider Amadeus between August 2023 and September 2026 may have been affected by the Amadeus cybersecurity incident; the airline gave no affected count and no list of data types, said its own IT systems were not breached, and said there is no evidence financial information was accessed.
What happened
We first flagged this on October 28, 2026 — here’s what changed. Update Nov 1, 2026, 20:00 ET: Added Malaysia Airlines’ statement of November 1, 2026 — a further airline confirming its customers in the same Amadeus incident, covering information processed through Amadeus between August 2023 and September 2026 — and Amadeus’s statement, reported by Reuters, that it had become aware of a vulnerability affecting a travel booking display environment. In an advisory published on its website on Saturday and reported on Sunday, November 1, Malaysia Airlines said the incident may have affected certain customer information processed through Amadeus, its reservation-technology provider, between August 2023 and September 2026. The airline said it is working closely with Amadeus and relevant parties to investigate the incident and assess its impact, and that its own IT systems were not breached.
Malaysia Airlines is the latest carrier to confirm its place in this incident. This desk has already reported the same Amadeus breach at Japan Airlines (about 92,000 customers, October 28), ANA (about 37,800 customers, October 30) and Cathay Pacific (about 53,000 bookings, October 30). Amadeus has still not said how many airlines or customers are affected in total.
Who is affected
Malaysia Airlines customers whose information was processed through Amadeus between August 2023 and September 2026. The airline has given no count of affected customers and has not said which types of personal information were involved for its customers — the data types reported at other airlines in this incident (booking references, names, flight details, and in smaller subsets contact details, travel document information and frequent flyer numbers) are those airlines’ disclosures, not Malaysia Airlines’, and this desk does not transfer them across. Malaysia Airlines said there is no evidence so far that financial information has been accessed.
How serious
The concrete risk the airline itself names is phishing: Malaysia Airlines urged customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information. A scammer who knows a traveller booked with Malaysia Airlines in the affected period can open with a believable “problem with your booking” approach even without the booking’s details. Because the airline has not yet said which data types its customers’ records included, the wider identity-misuse risk seen elsewhere in this incident cannot be confirmed or ruled out for Malaysia Airlines customers on the current disclosure; what is established is the exposure window, the provider, and the airline’s own phishing warning.
What to do now
Follow the airline’s advice: stay vigilant for suspicious or unsolicited messages about a Malaysia Airlines booking, especially any that request personal or financial information. Check any booking question inside the airline’s official website or app, which you open yourself — never through a link in a message — and do not pay change fees, verification charges or refund-processing fees requested by email, text or phone. If you are contacted about a booking from the August 2023 to September 2026 period, use the contact channels on the airline’s official site, and watch for a further statement: the airline says its assessment of the impact is still under way.
Sources: Reuters, via Business Today, November 1, 2026 · Scoop, quoting the Malaysia Airlines advisory, November 1, 2026 · Original report: Japan Airlines / Amadeus breach (October 28, 2026)