Summary
- Singapore Airlines reports approximately 46,000 affected booking records, including more sensitive information in around 620.
- Cathay Pacific has identified approximately 53,000 affected bookings, while Japan Airlines previously disclosed exposure involving around 92,000 customers.
- The incidents concern shared reservation technology rather than confirmed breaches of each airline's own infrastructure.
Passenger information held by Spanish travel technology company Amadeus has been exposed across several Asian airlines, with Singapore Airlines becoming the latest major carrier to confirm the impact of unauthorised access to its supplier’s reservation environment.
Singapore Airlines disclosed that approximately 46,000 booking records were accessed, including names, booking references, travel itineraries, and booking classes. More sensitive information may also have been exposed within a smaller group of approximately 620 records.
The disclosure adds to earlier notifications from Cathay Pacific and Japan Airlines, alongside reports involving Korean Air, Asiana Airlines, and Malaysia Airlines.
Amadeus has acknowledged a vulnerability affecting a travel booking display environment. The company says it has addressed the weakness and strengthened monitoring, while its investigation has found no evidence that payment or financial information was accessed.
Additional passenger records identified
Singapore Airlines said the exposed information included booking reference numbers, passenger names, itineraries, and booking classes associated with reservations processed through Amadeus.
For approximately 620 booking records, the accessed information may also have included email addresses, telephone numbers, travel document details, and KrisFlyer membership numbers.
The airline confirmed that its own information technology systems were not breached. It has contacted affected customers with upcoming travel to change their booking references as a precaution and notified the relevant authorities.
Amadeus told the carrier that bank account and credit card information had not been accessed and that the unauthorised activity had not resulted in modifications to bookings.
Cathay Pacific separately identified approximately 53,000 affected bookings. Its disclosure describes unauthorised access to reservation information held by Amadeus between August 2023 and September 2026.
According to Cathay Pacific, the access involved credentials assigned to an Amadeus system account. Most affected records contained booking references, names, and flight information, although a smaller proportion may also have included contact details, travel document information, or frequent-flyer numbers.
Cathay Pacific said its own systems and flight operations were unaffected. Amadeus subsequently reset the relevant credentials and introduced additional detection and monitoring measures.
Japan Airlines had already reported exposure involving approximately 92,000 customers through the same supplier environment, while other carriers have acknowledged varying levels of potential exposure.
Those figures cannot be combined into a reliable number of affected individuals. Airlines have used different measures, including booking records and customer counts, and the disclosures do not establish whether all records represent distinct passengers.
Shared infrastructure concentrates exposure
Airline reservation systems connect numerous operational functions, including booking management, ticketing, itinerary changes, passenger communications, and travel distribution.
Providers such as Amadeus allow carriers to use common technology while maintaining separate customer relationships and operational systems. Consequently, a weakness in the supplier’s environment can affect passenger information belonging to several organisations without requiring attackers to compromise each airline individually.
The confirmed use of an Amadeus system account in the Cathay Pacific case makes access governance particularly relevant. Shared service accounts require carefully defined permissions and monitoring because their authorised use may span multiple systems or datasets.
Amadeus has not publicly established whether the same account or technical route was responsible for every airline’s exposure. The incidents are linked through the supplier environment, but the precise access sequence remains subject to investigation.
The information accessed also creates different levels of potential misuse. A passenger name and itinerary may provide context for a convincing impersonation attempt, while contact details or travel document information can increase the sensitivity of an exposed record.
Those risks should not be confused with confirmed fraudulent activity. Amadeus says there is no evidence that the affected information has been misused, and it has found no indication that the vulnerability was exploited for ransomware.
For organisations processing personal information through external platforms, the incident illustrates the importance of understanding where records are stored, which supplier accounts can retrieve them, and how quickly unusual access can be identified.
European data protection requirements can also apply to personal information processed by technology providers, although notification and accountability responsibilities depend on the organisations’ respective legal roles and the circumstances of the incident.
Amadeus says it has fixed the vulnerability and remains in contact with customers and authorities. Affected airlines are continuing their assessments and notifications as the full scope of the reservation data exposure becomes clearer.
