The Amadeus data breach has produced a run of airline notices, and they do not say the same things. Amadeus IT Group, the travel technology provider behind many airline reservation systems, published a short statement in October 2026. Japan Airlines, Cathay Pacific and Asiana Airlines then each published their own notice about reservation data held in Amadeus systems.
This post puts the three notices side by side so you can see what each airline states, what it leaves open and what it asks customers to do. Every figure below comes from the notice itself.
What Does the Amadeus Data Breach Statement Say?
The Amadeus statement is dated October 2026 and has six short points. It says the company became aware of a vulnerability affecting a travel booking display environment, and that certain booking-display data was accessible through it.
Amadeus says it has no evidence that payment or financial data was accessed, while its investigations continue. It also says there are no indications that the vulnerability was exploited for ransomware purposes. It reports a fix, enhanced monitoring and detection, and direct dialogue with customers and authorities.
The statement gives no dates, no record counts and no list of airlines. Those details appear only in the airline notices.
How Do You Read This Table?
The three columns that differ most are the number, the data and the date. JAL counts customers, Cathay counts bookings, and Asiana gives no count, so the figures cannot be added together or ranked.
The notice dates are the dates of publication. They are not the dates of the access. JAL says it was told by Amadeus on 23 October 2026, Cathay on 28 October with more details on 29 October, and Asiana on 20 October at 10:49 PM KST. The notices do not say why the dates differ.
JAL calls its period the time in which traces of external access were identified: 10 August 2023 to 23 September 2026. Cathay gives August 2023 to September 2026. Asiana calls its period an estimate for the same months.
Why Do the Descriptions of the Cause Differ?
Amadeus describes a vulnerability in a booking display environment. Cathay says Amadeus reported unauthorised access by a party using login credentials assigned to its system account. Asiana says the same about credentials assigned to Amadeus system accounts.
JAL says only that its data had been accessed externally through unauthorized access to the Amadeus system. These descriptions are not necessarily in conflict, and none of the notices links the two. We do not draw that link either.
Cathay adds that Amadeus has taken containment actions, including a password reset, and has not identified evidence that the affected data was misused. Asiana says Amadeus reported blocking unauthorized access and starting dark web monitoring.
Which Exposed Fields Matter Most to a Reader?
A booking reference with a passenger name and flight details is the core of what all three airlines name. Our reading is that this is enough to make a convincing message that appears to come from the airline about a real trip. JAL and Asiana both warn about that kind of contact.
The smaller groups are more serious. JAL names passport number, nationality, ticket number and phone number for about 2,000 customers. Cathay names travel documents and frequent flyer numbers for a subset.
Travel document details can support identity fraud, and frequent flyer numbers can support account takeover attempts. That risk assessment is ours; the notices only list the fields.
What Should Customers and Security Teams Do?
Customers who fly these airlines should treat any message about a booking with care, even if it quotes the right booking reference. Use the airline’s own app or website instead of links in a message. If a passport number was in your notice, watch for identity-related fraud.
Security teams have a different job, because the data sat with a supplier. The abuse of assigned credentials maps, in our reading, to Valid Accounts. Our suggestions for vendor-held data:
- List which suppliers hold your customer or traveler data, and in which system.
- Ask each supplier how it rotates and monitors credentials assigned to system accounts.
- Ask what logs the supplier keeps and for how long, because these notices span about three years of access.
- Prepare phishing guidance for staff who travel, since a real booking reference makes a lure more believable.
This is the pattern described in our entries on third-party risk management and in the Santander third-party breach profile. For travel brands, see also our aviation and travel threat overview, and for the lure side, Phishing (T1566). For definitions, see what a data breach is.