Malaysia Airlines says Amadeus access may have exposed customer data

Malaysia Airlines said on Oct. 31, 2026 that customer information processed through Amadeus may have been exposed after unauthorized access to a booking-information environment from August 2023 to September 2026, a 37-month window. It released no affected-customer count. The airline said its own IT systems were not compromised and that there is no current evidence customer financial information was accessed. Amadeus said payment and credit-card data were kept separate and not compromised, and it rotated credentials and added monitoring. Amadeus notified airlines in late October after the September 2026 fix. Malaysia Airlines said it is treating the matter with the utmost seriousness and urged passengers to watch for suspicious messages seeking personal or financial details. Japan Airlines reported about 92,000 customers affected, including passport numbers and frequent-flyer information. Cathay Pacific reported about 53,000 bookings. All Nippon Airways reported about 37,800 customers. Korean Air and Asiana confirmed reservation numbers were exposed after Amadeus notice on Oct. 20, gave no counts, and reported the matter to the Personal Information Protection Commission. Jin Air’s separate Oct. 28 in-house breach was quickly scoped at 1,454 customers’ names, dates of birth, and mobile numbers. An industry official said outsourced vendors limit what carriers can do beyond demanding prevention measures, and that thorough vendor oversight in normal times should figure in how a company’s personal-data protection capability is assessed. Malaysia Airlines’ affected count and specific guidance for travel-agent bookings remain unresolved.