Updated November 2, 2026: Several airlines have disclosed that reservation information held in an Amadeus passenger-service system was accessed without authorization. The public notices do not establish that every airline using Amadeus, every booking in a stated date range, or every passenger on a named airline was affected. For Australian travelers, Qantas has said it is working with Amadeus to determine whether any Qantas bookings were involved; that is an assessment in progress, not confirmation that Qantas passenger records were accessed.
Malaysia Airlines has said certain customer information processed through Amadeus may have been affected. Other carriers, including Cathay Pacific, Japan Airlines, Japan Transocean Air, All Nippon Airways (ANA), Star Flyer, Korean Air, and Asiana Airlines, have published notices describing affected or potentially accessed reservation records. The best way to check your own situation is to compare your airline and booking with that airline’s latest notice, then contact the carrier through details on its official website or app.
The table summarizes public airline notices verified for this article as of November 2, 2026. It is a set of examples, not a complete global list. “Affected” can refer to a booking record or a customer whose information showed signs of access; it does not automatically mean every customer of that airline was affected.
| Airline | What its notice says | What remains uncertain |
|---|---|---|
| Malaysia Airlines | The airline says certain customer information processed through Amadeus between August 2023 and September 2026 may have been affected. It says its own IT systems were not compromised and there is currently no evidence financial information was accessed. Read the airline’s notice. | The notice does not give a customer count or identify the specific data fields. The airline says it is investigating. |
| Cathay Pacific | Cathay reported about 53,000 affected bookings. In most cases, the information included a booking reference, passenger name, and flight details. A smaller subset may have included contact details, travel-document information, or frequent-flyer numbers. Cathay said there was no evidence financial or payment information was accessed. Read Cathay’s notice. | The airline said it was still analyzing the data and would notify affected customers individually once it established the relevant details. |
| Japan Airlines and Japan Transocean Air | JAL reported about 92,000 customers in total: approximately 90,000 records with reservation code, name, travel date, route, and service class, and about 2,000 with additional details that could include email, phone, passport number, nationality, frequent-flyer number, and ticket or seat details. Read JAL’s notice. | JAL says affected customers were contacted using booking email addresses. That does not establish that every message claiming to be from JAL is genuine. |
| All Nippon Airways (ANA) | ANA reported approximately 37,800 customers with reservation data that appears to have been accessed. It says credit-card numbers and account passwords were not involved. Read ANA’s notice. | ANA says it will contact affected customers directly. Its listed customer total does not mean every ANA booking was affected. |
| Star Flyer | Star Flyer says signs of access involved certain reservations made from July 28, 2025, through September 23, 2026, and lists names, booking references, travel details, contact information, and frequent-flyer or ticket details among the information involved. Read Star Flyer’s notice. | The airline said it was still verifying the number of people affected. |
| Korean Air | Korean Air’s Korean-language notice says some customer reservation numbers showed signs of exposure through Amadeus. It says the investigation into other fields is continuing and its own database showed no signs of compromise. Read Korean Air’s notice. | The notice does not yet identify a final count or complete list of data fields. |
| Asiana Airlines | Asiana’s Korean-language notice says some reservation numbers showed signs of exposure through Amadeus and that other possible fields remain under review. It says its own database showed no signs of compromise. Read Asiana’s notice. | The airline says the exact timing and additional affected information are still being investigated. |
| Qantas | In a statement quoted by Australian media on November 2, Qantas said Amadeus had advised it of unauthorized access to one of its systems, that Amadeus said the issue was contained in September, and that Qantas was working to understand the impact to Qantas bookings. Qantas said its own systems and databases remained secure. Read the report quoting Qantas. | The statement does not confirm that Qantas booking records were accessed or identify any affected customers or data fields. |
Many notices describe an access or record period around August 2023 to September 2026, but the wording and exact dates vary by airline. JAL and ANA, for example, cite August 10, 2023, through September 23, 2026; Star Flyer cites a different start date. These are calendar-date windows, not a precise time of day or a statement that every booking in the window was accessed. The notices reviewed do not give an exact time zone for the unauthorized access. Their publication dates are separate: carrier notices appeared on dates from October 23 through October 31, with Qantas’s status reported on November 2.
A passenger name, booking reference, travel date, route, or cabin class is not the same as a payment-card number or an online-account password. However, trip details can make a scam message sound convincing. Keep the booking code private, and be suspicious of an unexpected call, email, or text that uses your route or travel date to pressure you into “verifying” a passport, payment, or account.
Some airlines have said card details or passwords were not involved, or that there is no evidence financial information was accessed. Those statements apply to the airline and records covered by that notice. Malaysia Airlines has not publicly specified the exact fields or number of customers that may be involved. Do not generalize one airline’s reassurance to another carrier or to an unconfirmed booking.
Likewise, an Amadeus connection does not by itself prove that an airline’s records were accessed. Amadeus provides technology to many travel companies, but the notices above describe different airlines, record sets, and data categories. The fact that a company uses a reservation provider is a reason to check its notice, not proof that every passenger was exposed.
Australia’s Australian Cyber Security Centre guide to recovering from a data breach recommends finding out what information was exposed, contacting the provider through details on its official website, avoiding links in unexpected messages, and monitoring accounts. Scamwatch’s phishing guidance also advises verifying a caller or message independently before sharing information. If you need identity or cyber-support planning, Cyber.gov.au points Australians to IDCARE.
A reservation-data incident does not by itself show that your itinerary changed or your flight was canceled. Several airlines in the notices above say their own systems or flight operations were not affected. Qantas, in its reported statement, says its systems and databases remain secure while it assesses the impact to bookings. For a trip, check the airline’s current flight-status page and your official booking record. Cancel or rebook only if the airline advises you to or your own travel circumstances call for it.
Bottom line for Australian travelers: check the airline named on your ticket, then check any operating carrier or travel agent involved. Malaysia Airlines has disclosed possible customer-information impact; Qantas is still assessing whether any Qantas bookings were involved; other airlines have published more specific exposure notices. No single public notice confirms every affected passenger. Use direct airline channels for a booking-level answer, and treat unexpected requests for passwords, one-time codes, passport details, or payment as unverified until you independently confirm them.
Learn how to assess Australian housing market conditions in your area using comparable sales, listings, selling times, rents, borrowing costs, supply data and local risks.
Learn how to apply for child support in Australia through Services Australia, check eligibility, prepare care and income details, choose collection, and review your assessment.
Several airlines have disclosed possible or confirmed Amadeus booking-data exposure. Check official notices, assess your booking, and reduce phishing risk.
The Commanders beat the Eagles 27–10 in Week 8. Find the official final score, box score, play-by-play, recaps and the UK kickoff time.
The Lakers beat the Raptors 131–125 on Nov. 1. See Luka Dončić’s confirmed stats, the UK time conversion, and where to find official scores and play-by-play.
Find the Clippers vs. Warriors tipoff time, Chase Center location, local TV and streaming options, radio stations, live box score and time-zone conversion.
The Pentagon is probing late-August military commissary freezer failures as a possible cyber incident. Here’s what officials confirmed and what remains unverified.
Check current Central Arizona flood alerts, Sedona-area warnings and highway closures, then follow practical steps to avoid flash-flood danger.
Alex de Minaur reached the 2026 Vienna final before Carlos Alcaraz won 6–1, 6–4. Here is the tournament format, recap, and official guide for Australians.
See every 2026 Block sale price, reserve, and profit above reserve, plus how Courtney and Sev won, what prize totals include, and how to interpret the numbers.
