Key Highlights: Malaysia Airlines Joins Airlines Affected by Amadeus Cybersecurity Incident
Malaysia Airlines Confirms Potential Data Exposure: The carrier announced on October 31, 2026, that customer information processed through Amadeus may have been exposed following unauthorised access to the technology provider’s systems.
Three-Year Exposure Window: The potentially affected data relates to the period between August 2023 and September 2026. The airline has not disclosed the number of customers potentially affected.
Airline’s Internal Systems Remain Secure: Malaysia Airlines confirmed that its own IT infrastructure was not compromised, with no current evidence that customers’ financial information was accessed.
Multiple International Airlines Affected: Japan Airlines (approximately 92,000 customers), Cathay Pacific (53,000 bookings) and All Nippon Airways (37,800 customers) have reported potential exposure. Korean Air and Asiana Airlines have also disclosed related concerns.
Passenger Information Potentially Exposed: Depending on the airline and affected booking, information could include passenger names, booking references, flight details, contact information, passport details and frequent-flyer numbers. Credit card information and passwords were not reported as compromised in the cited JAL and ANA cases.
Third-Party Cybersecurity Under Scrutiny: The incident highlights the risks of relying on shared reservation technology platforms. A security incident at one provider can potentially affect multiple airlines without compromising their individual IT networks.
Investigation Remains Ongoing: Malaysia Airlines and Amadeus are working to establish the extent of the potential exposure. Passengers are advised to remain alert to suspicious emails, calls, messages and phishing attempts using genuine-looking travel information.
Malaysia Airlines has become the latest international carrier to report a potential customer data exposure linked to a cybersecurity incident involving Amadeus, one of the aviation industry’s major airline reservation technology providers.
In a statement issued on October 31, 2026, the Malaysian national carrier confirmed that certain customer information processed through Amadeus may have been affected by unauthorised access to the technology provider’s systems.
The potential exposure covers a period between August 2023 and September 2026, spanning approximately three years.
Malaysia Airlines stressed that its own information technology infrastructure has not been compromised and that there is currently no evidence that customers’ financial information has been accessed.
The airline is working closely with Amadeus and other relevant parties to investigate the incident, establish the extent of the potential exposure and assess its impact on passengers.
The announcement adds Malaysia Airlines to a growing list of international carriers reporting customer data security concerns associated with the same third-party technology provider.
What Information May Have Been Exposed?
Malaysia Airlines has not yet disclosed the number of potentially affected customers or identified the specific categories of information involved.
However, the airline has confirmed that customer information processed through Amadeus during the affected period may have been exposed.
The distinction is important: the airline’s announcement confirms a potential impact, not that every customer who booked during the three-year period has had their information accessed.
Malaysia Airlines has also emphasised that:
Its internal IT systems have not been compromised.
There is currently no evidence of financial information being accessed.
The investigation is ongoing.
Further updates will be provided when additional information becomes available.
The airline has advised customers to remain vigilant against suspicious emails, telephone calls and other unsolicited communications, particularly those requesting personal or financial information.
A Wider Cybersecurity Concern Across the Aviation Industry
Malaysia Airlines is not an isolated case. The Amadeus incident has triggered security alerts across several major international airlines, highlighting the risks associated with shared reservation platforms.
The confirmed developments include:
1. Japan Airlines – Approximately 92,000 Customers Affected
Japan Airlines disclosed on October 30, 2026, that unauthorised access to Amadeus systems had potentially exposed reservation information belonging to approximately 92,000 customers of Japan Airlines and Japan Transocean Air.
According to the airline:
Approximately 90,000 customers had reservation codes, names, flight dates, routes and travel classes potentially accessed.
Approximately 2,000 additional customers may also have had email addresses, telephone numbers, passport numbers, nationalities and frequent-flyer information exposed.
Credit card numbers and passwords were not compromised.
JAL said Amadeus had implemented security measures and that there was no evidence of misuse of the affected information.
2. Cathay Pacific – Approximately 53,000 Bookings Affected
Cathay Pacific confirmed on October 30, 2026, that approximately 53,000 bookings were affected by unauthorised access to reservation information held by Amadeus.
The potentially accessed information included booking references, passenger names and flight details. A smaller number of bookings may also have involved email addresses, telephone numbers, travel document information and frequent-flyer numbers.
Cathay Pacific confirmed that its own systems and operations were unaffected and that there was no evidence of financial or payment information being accessed.
3. All Nippon Airways – Approximately 37,800 Customers Affected
All Nippon Airways (ANA) reported that approximately 37,800 customers may have had reservation information accessed through the Amadeus passenger service system.
The airline identified two groups:
Approximately 36,100 customers whose names, booking references, travel dates, flight routes and cabin classes may have been accessed.
Approximately 1,700 customers whose additional information, including passport numbers, contact details, nationality and frequent-flyer numbers, may also have been exposed.
ANA confirmed that credit card numbers and account passwords were not involved.
4. Korean Air and Asiana Airlines – Reservation Information Exposed
South Korean carriers Korean Air and Asiana Airlines also reported potential customer information exposure through Amadeus.
Korean Air confirmed that customer booking reference numbers were among the information potentially exposed, while Asiana reported unauthorised access involving reservation-related information.
Both airlines said there was no evidence that their own internal systems had been compromised. The full extent of the exposure remained under investigation.
The common factor: These incidents involve the same third-party reservation technology provider, rather than separate confirmed breaches of each airline’s internal IT infrastructure.
Similar Cybersecurity Incidents in the Aviation Industry
The latest Amadeus incident highlights a broader problem facing airlines: cybersecurity vulnerabilities within external technology providers can expose passenger information even when an airline’s own systems remain secure.
Several previous incidents demonstrate how serious these supply-chain risks can become.
Air France and KLM – Third-Party Customer Data Breach (2025)
In August 2025, Air France and KLM confirmed unauthorised access to customer information through an external platform used by their customer service departments.
The incident potentially affected hundreds of customers. Exposed information included names, contact details, Flying Blue membership information and the subjects of customer enquiries.
Both airlines confirmed that passwords, passport details, payment card information and travel data were not compromised. Their internal systems were also unaffected.
British Airways – Major Customer Data Breach (2018)
One of the aviation industry’s most significant cybersecurity incidents involved British Airways in 2018.
Hackers compromised the airline’s website and mobile application, potentially exposing personal and payment information belonging to approximately 429,612 individuals.
The compromised information included names, addresses and payment card details, with some customers’ card security codes also potentially exposed.
The incident resulted in a substantial regulatory investigation by the UK’s Information Commissioner’s Office (ICO), highlighting the financial and reputational consequences of inadequate cybersecurity protections.
Why Third-Party Cybersecurity Is a Growing Aviation Risk
Modern airlines rely on interconnected technology providers to manage essential operations, including:
Passenger Service Systems (PSS).
Global Distribution Systems (GDS).
Online reservations and ticketing.
Passenger check-in and boarding services.
Frequent-flyer programmes.
Customer relationship management platforms.
Airport and airline operational systems.
Companies such as Amadeus IT Group provide technology used across the global travel industry.
While outsourcing these services improves efficiency and allows airlines to operate sophisticated digital platforms, it also creates cybersecurity dependencies.
A vulnerability or unauthorised access incident affecting one technology provider can potentially expose information belonging to customers of multiple airlines simultaneously.
The Amadeus incident illustrates this supply-chain risk particularly clearly: several competing international airlines are investigating exposure linked to the same external technology environment.
Importantly, the currently reported incidents concern customer reservation information. There is no confirmed evidence that aircraft flight-control systems or flight operations have been affected.
What Should Malaysia Airlines Passengers Do?
Until the investigation establishes the full extent of the incident, customers should take precautionary measures.
Recommended passenger precautions:
Be cautious of emails or text messages claiming to provide booking updates or refunds.
Never disclose passwords, payment card details or verification codes in response to unsolicited communications.
Avoid clicking suspicious links or downloading unexpected attachments.
Verify booking-related communications through Malaysia Airlines’ official website or customer service channels.
Watch for fraudulent calls or messages containing genuine-looking flight details or booking references.
Report suspicious communications to the airline.
Customers should also remember that criminals can use legitimate-looking travel information to make phishing attempts more convincing.
The Bigger Picture: Aviation’s Digital Supply Chain Under Scrutiny
The Malaysia Airlines announcement adds another dimension to an increasingly important aviation industry challenge: protecting passenger information across complex, interconnected technology networks.
With Japan Airlines, Cathay Pacific, ANA, Korean Air, Asiana Airlines and now Malaysia Airlines reporting concerns linked to Amadeus, the incident demonstrates how a security weakness at a single technology provider can have consequences across international aviation.
For airlines, cybersecurity can no longer be limited to protecting their own networks. Stronger third-party security assessments, tighter access controls, continuous monitoring and more transparent incident reporting are becoming essential.
The key lesson for the aviation industry is clear: protecting passengers requires securing not only airline systems, but also every critical technology partner handling their information.
The investigation into the Amadeus incident continues, and the total number of potentially affected passengers across the participating airlines remains unknown.
Key Sources
FL360aero note: Malaysia Airlines has not disclosed the number of affected customers or the specific data categories potentially exposed. Figures published by JAL, Cathay Pacific and ANA relate to their respective investigations and should not be added together as a confirmed total of unique affected passengers. The involvement of other airlines should also not be interpreted as evidence that every customer booking processed through Amadeus was compromised.
——————————————————-
Click Here For The Original Source.
