6 NOV 2026 — Four Asian airlines posted customer notices between 29 and 31 October about the same incident at Amadeus IT Group, the Spanish company whose passenger service system runs reservations for carriers around the world. Cathay Pacific, All Nippon Airways (ANA), Malaysia Airlines and Star Flyer, a Japanese carrier that uses the system through ANA, each say an unauthorised party reached booking data held by Amadeus. Cathay and Malaysia Airlines add that their own systems were not breached. They do not describe the damage the same way, and only two of the four say how many people or bookings were involved.
We read each notice in full on the airline's own website and set them side by side. Where a notice is silent, the table says so instead of filling the gap from press coverage.
Four notices, side by side
| Airline | Notice dated | Scale stated | Data named | Payment and passport data | Advice to customers |
|---|---|---|---|---|---|
| Cathay Pacific | 30 Oct (last update 16:11 HKT) | About 53,000 bookings | Mostly booking reference, passenger name and flight details; for a smaller subset, also email and phone contacts, travel document or frequent flyer number | No evidence of financial or payment data accessed; travel documents possibly, in the subset | None beyond a promise to contact affected customers one by one |
| ANA | 30 Oct | About 37,800 customers | 36,100 customers: name, booking reference, travel date, routing, cabin class. 1,700 more: those items plus email, phone, passport number, nationality, frequent flyer, ticket and seat numbers | No card numbers or account passwords; passport numbers for about 1,700 | Treat emails, calls, websites and social media ads using the ANA name with caution |
| Star Flyer | 29 Oct, updated 30 Oct | Not stated; still being confirmed | Name, booking number, flight date, route, class, email, phone, mileage number, ticket and seat numbers, among others | Card details and passwords not included; passports not listed | Watch for messages, sites and social media ads posing as the airline |
| Malaysia Airlines | 31 Oct (page date) | Not stated | Not stated beyond "certain customer information" | No evidence so far of financial data accessed; passports not mentioned | Stay alert to unsolicited messages seeking personal or financial details |
Star Flyer's notice is in Japanese; its row is our translation. Malaysia Airlines' page carries no visible date, so the date shown is the one in the page's own metadata.
Two counts that cannot be added
Cathay counts bookings and ANA counts customers, so the two figures measure different things and we have not totalled them. One booking can cover several passengers, and one frequent traveller can appear in many bookings.
ANA's notice is the most specific. It sets the access window at 10 August 2023 to 23 September 2026, which is 1,140 days by our count, a little over three years. The 1,700 customers whose passport numbers may have been seen are about 4.5% of the 37,800 total. The notice is dated 30 October, 37 days after the window closed.
Star Flyer gives a shorter window. It says the affected customers are some of those who booked between 28 July 2025 and 23 September 2026, about 14 months. The airline receives its passenger service system through ANA and says it learned of the incident from ANA.
Cathay is the most explicit about how the intruder got in. It wrote in its notice that access came from an unauthorised party "using login credentials assigned to its system account", meaning an account belonging to Amadeus. It says Amadeus told it on 28 October and sent more detail the next day, and that Amadeus has reset the password and added monitoring. ANA's notice says the compromised credentials have been revoked.
Malaysia Airlines says the least. Its statement names no count and no data types, and gives the window only as August 2023 to September 2026.
Amadeus's account and the airlines'
We could not read Amadeus's own statement, because its website returned a bot-check page to our requests. BleepingComputer reported that Amadeus posted a statement on 1 October describing a vulnerability in a travel booking display environment, and that the company said at the time it had seen no ransomware use of the weakness and no exposure of payment data. The airline notices describe a different event. An outsider signs in with credentials issued to an Amadeus account and reaches reservation records stretching back, in most cases, to August 2023.
Japan Airlines also disclosed, but its own notice was not reachable for us, so its figures here are as reported. The Record reported on 28 October that 92,000 customers of JAL and Japan Transocean Air were affected, about 2,000 of them with passport numbers among the exposed details. Taken with ANA's 37,800, that would put the two Japanese groups alone at about 129,800 customers. Bloomberg, in a report carried by Insurance Journal, said Korean Air and Condor, a German airline, have also reported that their data was caught up.
No airline in this set reports evidence that the data has been misused, and Cathay passes on Amadeus's statement that it has found none. When BleepingComputer asked Amadeus how many airlines and markets were affected, the company had given no further detail by publication.
