Malaysia Airlines has become the latest international carrier to report a potential customer data exposure linked to a cybersecurity incident involving Amadeus, one of the aviation industry's major airline reservation technology providers.
In a statement issued on October 31, 2026, the Malaysian national carrier confirmed that certain customer information processed through Amadeus may have been affected by unauthorised access to the technology provider's systems.
The potential exposure covers a period between August 2023 and September 2026, spanning approximately three years.
Malaysia Airlines stressed that its own information technology infrastructure has not been compromised and that there is currently no evidence that customers' financial information has been accessed.
The airline is working closely with Amadeus and other relevant parties to investigate the incident, establish the extent of the potential exposure and assess its impact on passengers.
The announcement adds Malaysia Airlines to a growing list of international carriers reporting customer data security concerns associated with the same third-party technology provider.
Malaysia Airlines has not yet disclosed the number of potentially affected customers or identified the specific categories of information involved.
However, the airline has confirmed that customer information processed through Amadeus during the affected period may have been exposed.
The distinction is important: the airline's announcement confirms a potential impact, not that every customer who booked during the three-year period has had their information accessed.
Malaysia Airlines has also emphasised that:
The airline has advised customers to remain vigilant against suspicious emails, telephone calls and other unsolicited communications, particularly those requesting personal or financial information.
Malaysia Airlines is not an isolated case. The Amadeus incident has triggered security alerts across several major international airlines, highlighting the risks associated with shared reservation platforms.
The confirmed developments include:
Japan Airlines disclosed on October 30, 2026, that unauthorised access to Amadeus systems had potentially exposed reservation information belonging to approximately 92,000 customers of Japan Airlines and Japan Transocean Air.
According to the airline:
JAL said Amadeus had implemented security measures and that there was no evidence of misuse of the affected information.
Cathay Pacific confirmed on October 30, 2026, that approximately 53,000 bookings were affected by unauthorised access to reservation information held by Amadeus.
The potentially accessed information included booking references, passenger names and flight details. A smaller number of bookings may also have involved email addresses, telephone numbers, travel document information and frequent-flyer numbers.
Cathay Pacific confirmed that its own systems and operations were unaffected and that there was no evidence of financial or payment information being accessed.
All Nippon Airways (ANA) reported that approximately 37,800 customers may have had reservation information accessed through the Amadeus passenger service system.
The airline identified two groups:
ANA confirmed that credit card numbers and account passwords were not involved.
South Korean carriers Korean Air and Asiana Airlines also reported potential customer information exposure through Amadeus.
Korean Air confirmed that customer booking reference numbers were among the information potentially exposed, while Asiana reported unauthorised access involving reservation-related information.
Both airlines said there was no evidence that their own internal systems had been compromised. The full extent of the exposure remained under investigation.
The common factor: These incidents involve the same third-party reservation technology provider, rather than separate confirmed breaches of each airline's internal IT infrastructure.
The latest Amadeus incident highlights a broader problem facing airlines: cybersecurity vulnerabilities within external technology providers can expose passenger information even when an airline's own systems remain secure.
Several previous incidents demonstrate how serious these supply-chain risks can become.
In August 2025, Air France and KLM confirmed unauthorised access to customer information through an external platform used by their customer service departments.
The incident potentially affected hundreds of customers. Exposed information included names, contact details, Flying Blue membership information and the subjects of customer enquiries.
Both airlines confirmed that passwords, passport details, payment card information and travel data were not compromised. Their internal systems were also unaffected.
One of the aviation industry's most significant cybersecurity incidents involved British Airways in 2018.
Hackers compromised the airline's website and mobile application, potentially exposing personal and payment information belonging to approximately 429,612 individuals.
The compromised information included names, addresses and payment card details, with some customers' card security codes also potentially exposed.
The incident resulted in a substantial regulatory investigation by the UK's Information Commissioner's Office (ICO), highlighting the financial and reputational consequences of inadequate cybersecurity protections.
Modern airlines rely on interconnected technology providers to manage essential operations, including:
Companies such as Amadeus IT Group provide technology used across the global travel industry.
While outsourcing these services improves efficiency and allows airlines to operate sophisticated digital platforms, it also creates cybersecurity dependencies.
A vulnerability or unauthorised access incident affecting one technology provider can potentially expose information belonging to customers of multiple airlines simultaneously.
The Amadeus incident illustrates this supply-chain risk particularly clearly: several competing international airlines are investigating exposure linked to the same external technology environment.
Importantly, the currently reported incidents concern customer reservation information. There is no confirmed evidence that aircraft flight-control systems or flight operations have been affected.
Until the investigation establishes the full extent of the incident, customers should take precautionary measures.
Recommended passenger precautions:
Customers should also remember that criminals can use legitimate-looking travel information to make phishing attempts more convincing.
The Malaysia Airlines announcement adds another dimension to an increasingly important aviation industry challenge: protecting passenger information across complex, interconnected technology networks.
With Japan Airlines, Cathay Pacific, ANA, Korean Air, Asiana Airlines and now Malaysia Airlines reporting concerns linked to Amadeus, the incident demonstrates how a security weakness at a single technology provider can have consequences across international aviation.
For airlines, cybersecurity can no longer be limited to protecting their own networks. Stronger third-party security assessments, tighter access controls, continuous monitoring and more transparent incident reporting are becoming essential.
The key lesson for the aviation industry is clear: protecting passengers requires securing not only airline systems, but also every critical technology partner handling their information.
The investigation into the Amadeus incident continues, and the total number of potentially affected passengers across the participating airlines remains unknown.
FL360aero note: Malaysia Airlines has not disclosed the number of affected customers or the specific data categories potentially exposed. Figures published by JAL, Cathay Pacific and ANA relate to their respective investigations and should not be added together as a confirmed total of unique affected passengers. The involvement of other airlines should also not be interpreted as evidence that every customer booking processed through Amadeus was compromised.
.jpg)
