Amadeus, the Spanish company that runs booking and check-in systems for hundreds of airlines, is at the center of a widening data breach. Over the past two weeks a series of Asian carriers have said customer data was exposed through a flaw in an Amadeus system; the company told Recorded Future News it recently learned of a vulnerability affecting a booking display environment.
Japan Airlines says about 92,000 customers were affected, about 2,000 of them with more sensitive details such as passport numbers, and confirmed the flaw was maliciously exploited. Cathay Pacific reports about 53,000 bookings, mostly booking references, names and flight details. ANA reported about 37,800 records, and Korean Air, Asiana, Malaysia Airlines, Singapore Airlines, Condor and Jin Air have also confirmed impact.
Reports put the exposure window at August 2023 to September 2026, more than three years. Amadeus and the airlines say there is no evidence payment or card data was accessed.
What to do: anyone who flew these airlines in the last three years should be wary of messages impersonating the airline that use real flight details and ask you to verify information or pay. A booking reference and surname are enough to manage a booking on many sites, so check future bookings for unexpected changes.
