Amadeus Breach: How to Check Whether Your Airline Is Affected

If you have an upcoming flight, a frequent-flyer account, or an old booking with an airline that uses Amadeus, a headline about the Amadeus breach can leave you with a practical question: was your reservation actually involved? The answer is not the same for every airline or passenger. Some carriers have confirmed access to specific sets of booking records, while others are still assessing whether any of their customers' information was involved. Your safest first move is to check your airline's own security notice and contact channels, not a link sent in an unexpected text or email.

Information reviewed November 3, 2026 (Australian Eastern Daylight Time, AEDT, UTC+11). This date describes the review of available announcements, not when the unauthorized access occurred. As the investigation continues, airline-specific notifications may change.

What happened in the Amadeus security incident?

In its October 2026 statement, travel technology company Amadeus said it had identified a vulnerability involving a travel booking display environment. Certain booking-display information was accessible through that vulnerability. The company said it had addressed the weakness, strengthened monitoring, and remained in contact with customers and authorities. It also said it had found no evidence that payment or financial information was accessed and no indication of ransomware exploitation. Those statements do not establish that every type of personal information was safe or that the full investigation is finished.

Airline notices provide more specific descriptions of unauthorized access to reservation records. For example, Cathay Pacific's October 30 notice says an unauthorized party used credentials assigned to an Amadeus system account to access travel reservation information. It reports that the access involved records dated between August 2023 and September 2026. The exact scope of exposure is airline-specific; the existence of a booking during that period alone does not prove it was accessed.

Which airlines have disclosed a possible or confirmed impact?

The following is a source-based snapshot, not a complete worldwide list. It distinguishes airlines that published figures from airlines still determining their exposure. Numbers refer to different measures—bookings or people—and should not be added together as if they represent a single audited total.

An airline missing from this table is not necessarily unaffected. Equally, an airline's use of Amadeus technology does not mean all its reservations were accessible. Confirmed exposure must come from the airline's investigation or a reliable notification about your specific record.

How to check whether your airline—and your booking—was affected

1. Go directly to the airline's website or app

Open the airline's website by typing its familiar address yourself or using a saved official app. Look for a page titled Security notice, Data incident, Customer advisory, or Important information. Check the publication date and any later amendments. If you booked through a travel agency or a third-party travel site, also contact the company that issued your itinerary. It may be able to identify the operating and ticketing carriers, but it cannot always determine whether a record held by Amadeus was accessed.

2. Check notifications without trusting the message's links

Search your inbox and spam folder for the airline's name, "Amadeus," "security incident," and "data breach." Some airlines have indicated that they will notify or have already notified identified customers individually. A notice may legitimately arrive by email, but that alone does not make it authentic. Do not click a message's login or payment link, call an unfamiliar number in it, or reply with your passport details. Use the airline's published support contact information to confirm the message.

3. Compare the dates, but do not treat them as a definitive test

Several airline advisories refer to reservations or access records from August 2023 through September 2026, with precise start and end dates varying by disclosure. Review your past flights as well as upcoming trips if the airline identifies that period. A reservation inside the window is a reason to investigate, not proof that your data was taken; a flight booked outside one airline's described window should not be used to infer what happened at a different carrier.

4. Ask the airline about your record

If the advisory does not answer your question, contact the airline through its official support page. Explain the airline and booking period, and ask: "Has my reservation been identified as part of the Amadeus incident, which data fields were involved, and what specific protective steps do you recommend?" Have your booking details available privately, but share them only after confirming you are in the airline's official support channel. Ask whether the response is final or whether the review remains underway.

5. Verify your trip separately

Sign in to the airline app or visit its official Manage Booking function to check that your flight, passenger details and contact information are correct. Review any unfamiliar changes with the carrier. A normal-looking itinerary does not prove your personal information was not exposed. Conversely, the breach notices reviewed here do not themselves establish that your flight has been canceled or that check-in systems are unavailable. Japan Airlines, for example, explicitly said its flight operations were unaffected in its October 30 notice.

What information might have been exposed?

The confirmed data categories differ by airline. The more common fields cited in Cathay, JAL and ANA notices include passenger names, booking reference numbers (PNRs), flight dates, routes and cabin classes. Smaller subsets may include phone numbers, email addresses, passport details, ticket numbers, seat assignments and loyalty numbers. No verified statement reviewed for this article establishes that airline account passwords or card numbers were accessed in this incident; Amadeus has explicitly reported no evidence of financial or payment-data access. This is a statement about current evidence, not a guarantee against all fraud.

A booking reference paired with a name can be sensitive because some airline booking tools use those details to retrieve itinerary information. The implications depend on the carrier's own verification controls. Avoid posting itinerary screenshots or sharing a PNR in public comments, even if your flight has already taken place. Detailed travel information can also help criminals write convincing impersonation messages about schedule changes, refunds or baggage claims.

What should you do if your information was involved?

1. Start with phishing protection. Treat unexpected messages about refunds, seat upgrades, compensation or urgent verification as untrusted until checked in the airline's official app or website. Scammers may refer to real flight details.
2. Protect the accounts that matter. Use unique passwords and enable multifactor authentication on your email and airline accounts. A password change is especially important if you see unfamiliar login activity or have reused a password elsewhere; do not assume this incident itself exposed passwords when the official disclosures do not say so.
3. Watch bookings and loyalty accounts. Check for changes to contact details, reservations, redemption activity or account recovery settings. Notify the airline promptly if something does not belong to you.
4. Handle passport information proportionately. If your airline says a passport number was among the data accessed, ask what measures it recommends and contact the passport-issuing authority for identity-security guidance. An exposed passport number does not automatically mean the physical passport is invalid or must be replaced.
5. Escalate actual financial or identity misuse. If you notice unauthorized card payments, contact your bank immediately. In Australia, Australian Cyber Security Centre guidance explains account protection and reporting, while the Office of the Australian Information Commissioner explains responses based on the kinds of personal information exposed.

Australia's Scamwatch guidance on scams following a data breach advises contacting organizations through their official websites or apps rather than trusting links in messages. If you believe identity misuse has occurred, the Australian Cyber Security Centre also directs people toward reporting services and identity-support organizations.

Can an online breach checker tell you if your flight was exposed?

Not reliably for this specific incident. A general email-breach lookup may help identify whether an email address appears in some known datasets, but it cannot prove which Amadeus reservation record was accessed. No universal, official Amadeus passenger lookup has been established in the verified notices reviewed here. Be skeptical of any site advertising an instant "Amadeus passenger check" that requests your PNR, passport scan, full date of birth, or payment information.

If you cannot find a notice, that means only that you have not located a notice. It does not guarantee your booking was excluded. Some airlines are still analyzing affected records and may provide more specific notifications later. Keep the original booking confirmation in a secure place and check the official advisory again if new information is released.

What about Qantas passengers and the separate 2025 incident?

For Australian travelers, the distinction matters. The November 2026 reporting about Amadeus concerns a third-party reservation technology system and Qantas's assessment of any impact on its bookings. Qantas also has an official page about a different cyber incident from July 2025, involving a customer-service platform. Do not mistake that earlier page for proof of your exposure to the Amadeus incident, and do not combine the two incidents' data totals or descriptions.

If you are a Qantas customer, start with Qantas's current support channels and ask specifically about the 2026 Amadeus incident. You may need to distinguish a Qantas-operated flight from a codeshare flight ticketed by another airline. The carrier or agency handling the reservation can tell you which support team should investigate, but only its verified incident process can establish individual exposure.

How to tell when you have finished checking

Use a simple three-part result: (1) you have found an official airline advisory or received an answer from verified support; (2) you know whether your own booking is confirmed affected, confirmed not affected, or still under review; and (3) you have taken steps suited to the specific data involved. Record the date of the airline's response and any reference number, and revisit the notice if the investigation remains open.

Bottom line: the Amadeus incident is real, and several carriers have identified affected reservation data, but "airline uses Amadeus," "airline has an incident notice," and "your booking was accessed" are three different claims. Check the airline's primary announcement, seek confirmation through official support, and protect your accounts against targeted scams while the remaining questions are investigated.