Amadeus breach: ANA, Cathay Pacific and Malaysia Airlines say their passengers’ bookings were reached too

Last week we wrote that someone used valid login details to get into Amadeus, the booking system behind many of the world’s airlines, and read reservation records for Japan Airlines, Korean Air and Asiana passengers. Since then, three more airlines have said their customers are involved: All Nippon Airways (ANA), Cathay Pacific and Malaysia Airlines. If you booked with one of them between August 2023 and September 2026, here’s what each has said.

ANA: about 37,800 customers

On October 30, 2026, ANA said an updated report from Amadeus showed that some customer reservation data had been accessed. It covers about 37,800 customers who booked with ANA between August 10, 2023 and September 23, 2026:

• about 36,100 customers: name, booking reference (PNR), travel date, route and class of service
• about 1,700 customers: all of that, plus email address, phone number, passport number, nationality, frequent flyer number, airline, flight number, e-ticket number and seat number, among other details

ANA says no credit card numbers or account passwords were involved, that the stolen login details have been revoked and that monitoring has been stepped up. It will contact affected customers directly.

Cathay Pacific: about 53,000 bookings

Cathay Pacific said on October 30 that Amadeus told it on October 28 and sent more details on October 29. About 53,000 Cathay Pacific bookings were affected by access that took place between August 2023 and September 2026. In most of them, the booking reference, passenger name and flight details were accessed. In a smaller group, other details may have been too, including email and phone contacts, travel documents and frequent flyer numbers.

Cathay says there’s no evidence that financial or payment information was accessed and that its own systems weren’t affected. It says Amadeus reset passwords, added monitoring and hasn’t found any misuse of the data so far. Cathay has told the authorities and will notify affected customers individually once it has worked out the details. Amadeus told Reuters it had become aware of a vulnerability affecting a travel booking display environment, but didn’t say how many airlines or customers are affected.

Malaysia Airlines: details not given yet

Malaysia Airlines said in a statement on its website on October 31 that the incident may have affected some customer information processed through Amadeus between August 2023 and September 2026, The Star reported. It says its own systems weren’t compromised and there’s no evidence so far that financial information was accessed. It hasn’t said how many customers are affected or what kinds of data, Malay Mail noted. It says it will share more as it learns more.

What this means for you

The risk is the same as with the earlier airlines. A booking reference and your name can be enough to open a booking, and a scam message that quotes your real flight is easy to believe. If your passport number or contact details were among those seen, expect more targeted attempts. More airlines may still come forward as they finish checking.

What you can do

1. Watch for a message from your airline. ANA and Cathay say they will contact affected customers individually.
2. Don’t trust a message just because it knows your flight. Open your airline’s app or type its website address yourself.
3. Never pay a surprise fee or share a card number to “fix” a booking after an unexpected call, email or text.
4. Check upcoming bookings and your frequent flyer account for changes you didn’t make, and add a PIN or passkey if the airline offers one.
5. Learn the patterns. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you book travel with an address of its own, so a leak in a booking system doesn’t lead scammers straight to your main inbox. Frame never collects or stores the leaked records themselves.

Sources

• All Nippon Airways, Regarding Unauthorized Access to Passenger Service System Provided by Amadeus, October 30, 2026
• Cathay Pacific, Personal data security incident involving a third-party service provider, October 30, 2026
• Reuters via CNA, Cathay Pacific says Amadeus breach affected 53,000 bookings, October 30, 2026
• The Star, Malaysia Airlines says customer data may be affected by Amadeus breach, November 2, 2026
• Malay Mail, Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach, November 1, 2026