Amadeus Platform Breach Exposed Passenger Records at Multiple Airlines
Summary
The article reports unauthorized access to Amadeus’s airline distribution platform using valid credentials, with multiple carriers disclosing passenger-record exposure. It cites affected customer counts and warns PNR data may enable targeted phishing; investigators said
Key points
- The article says intruders used valid system credentials to access Amadeus’s distribution hub rather than individual airline networks.
- Japan Airlines disclosed exposure affecting about 92,000 customers; All Nippon Airways reported about 37,800 passenger files, and Cathay Pacific reported 53,000 reservation folders.
- Malaysia Airlines warned travelers about potential exposure; Korean Air and Asiana Airlines were auditing possible exposure.
- The exposed bookings reportedly span August 2023 through September 2026.
- Japan Airlines reported exposure of passport numbers, contact channels, and frequent-flyer profiles for about 2,000 travelers; ANA reported about 1,700 passport references.
- Amadeus reportedly revoked affected access tokens, changed administrative passwords, and increased security monitoring. Malaysia Airlines said its internal mainframes remained intact.
- Investigators reportedly found no evidence of exposed banking credentials, payment-card details, account passwords, or ransomware activity. The article warns that PNR codes may support targeted phishing and advises checking travel changes through official airline channels.
Article Details
- Victim Organization
- Amadeus was the third-party platform breached. Affected or potentially affected airline customers named in the article are Malaysia Airlines, Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air, and Asiana Airlines.
- Incident Type
- Unauthorized access to a centralized travel distribution platform using valid system credentials, exposing passenger booking and travel records.
- Data Types Exposed
- Passenger booking and travel records
- Passenger Name Record (PNR) codes
- Passport numbers or references
- Contact information
- Frequent flyer profiles
- Affected Records
- Japan Airlines reported approximately 92,000 customers affected, including about 2,000 with exposure of passport numbers, contact channels, and frequent flyer profiles. All Nippon Airways reported approximately 37,800 passenger files affected, including roughly 1,700 passport references. Cathay Pacific reported 53,000 reservation folders affected. These figures are airline-specific and are not an overall total.
- Operational Impact
- Amadeus revoked affected access tokens, changed administrative passwords, and increased security monitoring. Malaysia Airlines said its internal mainframes remained intact. The exposed bookings dated from August 2023 through September 2026.
- Ransom Or Extortion
- Security analysts identified no ransomware activity associated with the intrusion. No ransom or extortion was reported.
- Claim Status
- confirmed