You book a flight on an airline’s website. But the booking may not stay on the airline’s own computers. Many airlines keep them on a system run by a company called Amadeus, based in Spain. Someone broke into that system. Now Japan Airlines, Cathay Pacific, Singapore Airlines and other airlines say passengers’ booking details were seen. News reports call it the Amadeus cyberattack.
What Went Wrong?
Amadeus told Japan Airlines on 23 October 2026. Cathay Pacific got the news on 28 October. Both airlines say the outsider was in the records from August 2023 to September 2026. That is more than three years.
Other airlines followed. Malaysia Airlines warned customers at the end of October. Singapore Airlines spoke on 3 November. Korean Air and Asiana Airlines have reported breaches too. Cathay Pacific and Singapore Airlines say their own computers were safe. Japan Airlines uses Amadeus for reservations, ticketing and check-in, and says its flights were not affected. Amadeus says it has fixed the weak spot and is watching its systems more closely.
How Did They Get In?
Amadeus and Cathay don’t tell quite the same story. Amadeus calls it a weakness in a part of its system that shows bookings. Cathay says Amadeus told it that someone used a login made for a system account. That’s a login for software or staff, not for passengers. Nobody has said how the login was found. Cathay also says Amadeus works with hundreds of airlines.
How Much Data Was Seen?
The numbers are hard to compare, because each airline counts something different. Japan Airlines says about 92,000 customers. Most had a booking code, name, flight date, route and travel class in the data. About 2,000 also had an email address, phone number and passport number.
Cathay Pacific counts bookings and says about 53,000. Singapore Airlines counts booking records and says about 46,000. About 620 of those also had contact or travel document details. A person, a booking and a record are three different things. Adding the numbers up would give a wrong total.
Can Scammers Use It?
The airlines and Amadeus say there is no sign that payment details were taken. Japan Airlines says no passwords were taken either. That helps. But a real booking code and flight date can make a fake email look real. Japan Airlines asks customers to watch out for strange emails, calls and websites. So far, Cathay and Japan Airlines say Amadeus has found no misuse of the data.
What Comes Next?
Amadeus hasn’t said how many airlines or people are affected. The Record asked, and it wouldn’t say. Malaysia Airlines hasn’t given a number or said when it found the breach.
Cathay Pacific says it will write to affected customers one by one. Singapore Airlines is writing to people with trips coming up so they can get a new booking code. Amadeus says it is talking to its customers and the authorities.
The airlines say payment details were not taken, but names and trip plans can still be misused. If you flew with one of these airlines, read its notice. If an email about your booking seems odd, don’t click anything. Call the airline yourself.
