Several airlines in the Asia-Pacific region, including Cathay Pacific and Japan Airlines, have confirmed that passenger booking data was compromised in a security breach involving global travel technology provider Amadeus. Qantas is investigating whether its bookings were also affected.
Amadeus said it had identified a vulnerability in its travel booking display environment that allowed certain booking data to be accessed. The company has since implemented measures to address the vulnerability and strengthened its monitoring and detection capabilities.
“Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed. There are no indications that this vulnerability has been exploited for ransomware purposes,” Amadeus said in a statement.
Cathay Pacific confirmed that it had been notified by Amadeus on October 28 of unauthorised access to travel reservation data held in the provider’s systems.
Approximately 53 000 Cathay Pacific bookings were affected by the unauthorised access, which took place between August 2023 and September 2026.
“In most cases, the information accessed included booking references, passenger names, and flight details. In a smaller number of cases, additional personal information, including email and phone contacts, travel documents and frequent flyer numbers were potentially accessed. However, there is no evidence that financial or payment information was accessed,” said the airline.
Qantas said Amadeus had contained the issue in September and that it was working with the provider to determine which of its data had been affected, according to Australian Aviation.
