What Is the Amadeus Cyber Incident, and Why Has Malaysia Airlines Warned Customers?

Malaysia Airlines has warned customers that some of their personal information may have been affected by a cybersecurity incident involving Amadeus, the third-party technology provider used for its airline reservation services.

In a notice published on 31 October 2026, the airline said the incident may have affected customer information processed through Amadeus between August 2023 and September 2026. It also stressed that its own IT systems had not been compromised and that there was currently no evidence that financial information had been accessed.

The warning comes after other airlines, including Cathay Pacific, Japan Airlines and All Nippon Airways (ANA), disclosed that customer reservation information had been accessed through Amadeus systems.

However, an important question remains unanswered: what information relating to Malaysia Airlines customers may have been exposed, and how many people could be affected?

The airline has not yet provided those details. Here is what is known, what other airlines have disclosed, and what customers should watch for.

What is the Amadeus cyber incident?

Amadeus is a travel technology company that provides reservation and other technology services to airlines and businesses across the travel industry. Its systems help support processes such as flight reservations, ticketing and passenger services.

Airlines use third-party technology providers because managing reservations, passenger information and other travel operations requires complex systems. This also means that some customer information may be processed outside an airline’s own IT environment.

That distinction matters in this incident.

Malaysia Airlines says the cybersecurity incident involved Amadeus, which provides its reservation technology. The airline has specifically stated that its own IT systems have not been compromised.

In other words, the incident concerns a technology provider used by the airline, rather than a confirmed intrusion into Malaysia Airlines’ own IT network.

Amadeus has not publicly provided a complete account of the incident’s technical details in the information reviewed for this report.

What did Malaysia Airlines say about the incident?

Malaysia Airlines published its customer notice on 31 October 2026.

According to the airline, certain customer information processed through Amadeus between August 2023 and September 2026 may have been affected.

The airline made three important points:

• Its own IT systems have not been compromised.
• There is currently no evidence that financial information has been accessed.
• It is working with Amadeus and relevant parties to investigate the incident and assess its impact.

Malaysia Airlines also advised customers to remain alert to suspicious or unsolicited communications, particularly messages or calls requesting personal or financial information.

However, the notice did not identify the exact information that may have been affected. It also did not disclose how many customers could be involved.

That means customers should not assume that their passport numbers, payment details or other specific information were exposed. The airline has not confirmed that.

You can read the official Malaysia Airlines cybersecurity notice.

Which other airlines have reported customer data exposure?

Malaysia Airlines is not the only carrier to have disclosed a problem involving Amadeus reservation systems.

Several airlines have published notices describing unauthorised access to reservation information. Their disclosures provide a clearer picture of the types of records that may have been involved, although their figures must not be treated as a total for all affected airlines.

Cathay Pacific: Around 53,000 bookings affected

Cathay Pacific published a notice on 30 October after being informed by Amadeus about unauthorised access to reservation data.

The airline said it was notified on 28 October and received further information on 29 October.

According to information provided by Amadeus, around 53,000 Cathay Pacific bookings were affected. In most cases, the information accessed included:

• Booking reference
• Passenger name
• Flight details

A smaller group of bookings also involved additional information, including email addresses, telephone numbers, travel-document details and frequent flyer numbers.

Cathay Pacific said there was no evidence that payment information had been accessed. It also said its own systems and flight operations were not affected.

One important detail in Cathay Pacific’s notice concerns how the unauthorised access was described. The airline said the unauthorised party used login credentials assigned to its system account.

That tells us how access to the relevant account was described by Cathay Pacific. It does not explain how those credentials were obtained, who obtained them or whether the same method was used in other airlines’ cases.

Read Cathay Pacific’s personal data security notice.

Japan Airlines: Around 92,000 customers affected

Japan Airlines (JAL) and Japan Transocean Air disclosed that they had been informed by Amadeus on 23 October 2026 that traces had been found indicating some reservation information had been accessed externally.

Their notice identifies the period in which traces of external access were found as 10 August 2023 to 23 September 2026.

JAL estimated that around 92,000 customers were affected across the two airlines.

The information potentially accessed was divided into two groups:

• Around 90,000 customers: Reservation code, passenger name, flight date, flight sector and class of service.
• Around 2,000 customers: The information above, together with additional details such as email address, telephone number, passport number, nationality, frequent flyer number, flight number, ticket number and seat number.

JAL said credit card numbers and passwords had not been compromised. It also reported no evidence that the information had been misused and said the incident had not affected flight operations.

The airline said it had contacted affected customers and provided a dedicated inquiry service.

The details are available in Japan Airlines’ official notice.

ANA: Around 37,800 customers affected

All Nippon Airways (ANA) also published a notice on 30 October.

The airline said it had received an updated report from Amadeus indicating that an unauthorised third party had gained access to its systems and that certain customer reservation data appeared to have been accessed.

ANA estimated that around 37,800 customers who made reservations between 10 August 2023 and 23 September 2026 were affected.

Its notice separates the information into two groups:

• Around 36,100 customers: Name, booking reference, travel date, flight routing and cabin class.
• Around 1,700 customers: The information above, together with details including email address, telephone number, passport number, nationality, frequent flyer number, flight number, e-ticket number and seat number.

ANA said credit card numbers and account passwords were not involved. It also said the compromised authentication credentials had been revoked and monitoring had been strengthened.

The airline said it would contact affected customers directly.

Read ANA’s official notice.

What the airline disclosures tell us

Airline	Reported scope	Important qualification
Cathay Pacific	Around 53,000 bookings	Bookings, not a confirmed number of individual people
Japan Airlines and Japan Transocean Air	Around 92,000 customers	Includes two groups with different categories of information
ANA	Around 37,800 customers	Includes two groups with different categories of information
Malaysia Airlines	Not disclosed	Number of potentially affected customers and specific data types remain unknown

These figures should not be added together and presented as the total number of people affected by the incident. They relate to separate airline disclosures, and Cathay Pacific’s figure refers to bookings rather than individual customers.

They also do not establish how many Malaysia Airlines customers may be affected.

How did the unauthorised access happen?

This is one of the most important questions, but the public information does not yet provide a complete technical explanation.

Cathay Pacific’s notice says an unauthorised party accessed reservation data in Amadeus systems using login credentials assigned to its system account.

That is a specific detail from Cathay Pacific’s disclosure. However, it does not establish how the credentials were obtained or whether the same access method affected other airlines.

Reuters also reported that Amadeus had become aware of a vulnerability affecting a travel-booking display environment. Amadeus did not provide Reuters with the number of customers whose data may have been affected.

A vulnerability in a booking display environment is relevant, but the available reporting does not establish that it was the confirmed entry point for every airline’s affected records.

It would therefore be premature to describe the incident as a confirmed password theft, a specific software exploit or a single attack method affecting every airline.

The exact technical route, the identity of the unauthorised party and the full extent of the incident remain unclear from the public information reviewed.

Why are airline booking details sensitive?

A flight reservation is more than a record showing that someone has purchased a ticket.

Airlines use a Passenger Name Record, commonly called a PNR, to store information associated with a booking. Depending on the reservation and the airline, this can include a passenger’s name, travel itinerary, ticket details, contact information, seat information and other travel-related records.

The UK government’s explanation of Passenger Name Record data describes the types of information that may form part of these records. The exact contents can vary.

A booking reference is also important because it helps an airline locate a reservation in its systems. It should not be treated as a harmless piece of information to share publicly.

The risk is not that every booking reference automatically gives someone control of a passenger’s flight. Airlines use different verification and security procedures. Rather, reservation details can provide information that makes it easier for a criminal to create a convincing impersonation attempt.

For example, a message that includes a passenger’s name, destination and travel date may appear more believable than a random email claiming that a flight has been cancelled.

Could criminals use exposed travel details to target passengers?

This is a potential risk, not evidence that criminals have already misused information from this incident.

The UK National Cyber Security Centre warns that criminals can use information obtained in data breaches to make phishing emails and texts appear more convincing. They may also impersonate an organisation associated with a recent breach.

In an airline-related scenario, a criminal could attempt to use travel information to create a message that appears to come from an airline or booking service.

For example, a passenger might receive a message claiming:

• Their flight has been changed and they must confirm their booking.
• A refund is waiting and they need to provide payment details.
• Their reservation needs urgent verification.
• Their booking has a problem that requires an additional payment.

A scammer could also use a phone call rather than an email or text. If the caller already knows a passenger’s name, route or travel date, the conversation may sound more credible.

These are realistic phishing scenarios based on the type of information involved. They are not confirmed examples of misuse connected to the Amadeus incident.

The distinction is important: the airlines have reported unauthorised access to reservation information, but the public notices reviewed do not establish that criminals have used the affected records to defraud passengers.

What should Malaysia Airlines customers do now?

Malaysia Airlines has advised customers to remain vigilant against suspicious or unsolicited communications. That advice is particularly relevant while the airline and Amadeus continue investigating the incident.

Customers can take a few practical steps.

Check flight information through official channels.

If you receive a message about a cancelled flight, booking change or refund, do not rely on the link or telephone number in that message. Open the airline’s official website or app independently and check your reservation there.

Be cautious if a caller knows your travel details.

A caller knowing your name, destination or flight date does not prove that they represent the airline. Do not treat knowledge of your booking as proof of identity.

Do not provide payment details in response to an unexpected request.

Be especially careful with messages demanding an urgent payment to keep a booking active, release a refund or avoid cancellation. Verify the request directly with the airline.

Keep your booking reference private.

Avoid posting booking confirmations, e-tickets or reservation screenshots publicly. These can contain information that should not be shared unnecessarily.

Be careful with unexpected links and attachments.

Do not enter passwords, payment details or travel-document information on a page reached through an unsolicited message. Visit the airline’s official website independently instead.

The UK National Cyber Security Centre’s guidance on phishing after data breaches explains why information exposed in a breach can make fraudulent messages appear more genuine.

If you have already shared a password, payment information or other sensitive details with someone you now suspect is a scammer, take action based on what you disclosed. Contact your bank immediately if financial information or money is involved, change any affected or reused passwords, and report the suspicious communication through the appropriate official channels.

For UK readers, suspicious emails can be forwarded to report@phishing.gov.uk, and suspicious text messages can be forwarded to 7726. The UK government’s reporting guidance explains the available options.

Has financial information been stolen?

There is currently no evidence in Malaysia Airlines’ public notice that financial information has been accessed.

That statement should not be interpreted as confirmation that every type of customer information is safe. The airline has said that certain information processed through Amadeus may have been affected, but it has not yet specified the categories of data involved.

Other airlines have also made their own statements about payment information. JAL and ANA said credit card numbers were not compromised in the cases they disclosed. Cathay Pacific said it had no evidence that payment information was accessed.

Those statements apply to the airlines that issued them. They should not be used to make assumptions about the exact information involved in the Malaysia Airlines case.

Until Malaysia Airlines provides more details, the specific information potentially affected for its customers remains unknown.

What remains unknown about the Malaysia Airlines incident?

Although several airlines have disclosed more detailed information, important questions remain unanswered in Malaysia Airlines’ case.

At the time of this publication check on 1 November 2026:

• The number of Malaysia Airlines customers potentially affected has not been disclosed.
• The specific categories of customer information involved have not been identified.
• The airline has not publicly explained how the unauthorised access occurred.
• The identity of the person or group responsible has not been established in the public information reviewed.
• The airline has not confirmed that affected information has been misused.

These gaps matter. Information disclosed by Cathay Pacific, JAL and ANA helps explain the wider incident, but it cannot be used as a substitute for Malaysia Airlines’ own findings.

Customers should follow the airline’s official updates rather than assume that every passenger was affected or that every type of personal information was exposed.

Why this incident matters beyond one airline

The incident highlights a wider cybersecurity issue for the travel industry: airlines depend on external technology providers to support important services, including reservation systems and passenger information.

That does not mean using a third-party provider is inherently unsafe. It does mean that a security incident at a supplier can have consequences for customers of organisations that rely on its services.

A company can maintain its own systems without a known compromise while customer information processed by an external provider may still be affected.

For passengers, this distinction can be difficult to see. They book with an airline, receive a confirmation from the airline and expect their information to be protected. They may not know which technology companies help process the reservation behind the scenes.

The Amadeus incident demonstrates why organisations need to understand the security of the services and systems that handle customer information on their behalf.

What happens next?

Malaysia Airlines says it is working with Amadeus and relevant parties to investigate the incident and assess its impact. It has promised to provide further updates when more information becomes available.

The next important details will be whether the airline identifies the number of potentially affected customers, explains which categories of information were involved and provides specific guidance to passengers who may be affected.

For now, customers should remain alert to unexpected messages or calls claiming to relate to their flights, bookings or refunds. They should verify any request directly through official airline channels.

The central point is that Malaysia Airlines has confirmed a potential impact on customer information processed by Amadeus, but it has not yet confirmed the scale or exact data involved. Until the airline provides those details, stronger claims about what was exposed would go beyond the available evidence.