Malaysia Airlines Warns Customers of Amadeus Data Breach

KUALA LUMPUR — Malaysia Airlines has warned that a cybersecurity incident involving reservation technology provider Amadeus may have affected customer information processed between August 2023 and September 2026.

The carrier said in its customer advisory that its own IT systems were not compromised and that it currently has no evidence financial information was accessed. It is investigating with Amadeus and other relevant parties.

The disclosure adds Malaysia Airlines to a group of carriers reporting exposure through the same technology supplier. Reuters reported that Cathay Pacific identified 53,000 affected bookings, while Asiana Airlines was also among the carriers involved. Amadeus told the news agency it had identified a vulnerability affecting a travel-booking display environment.

What Passenger Information Was Affected?

Japan Airlines and Japan Transocean Air disclosed approximately 92,000 affected customers. For about 90,000, the information included reservation codes, names, flight dates, sectors and travel classes. Around 2,000 had additional information accessed, including contact details, passport numbers and frequent flyer numbers.

Those are the Japanese carriers' findings. Malaysia Airlines' advisory does not specify the affected data fields or customer count. The Cathay booking figure and Japanese customer figure measure different things and cannot establish an industrywide passenger total.

Malaysia Airlines urged customers to watch for unsolicited messages seeking personal or financial information. Japan Airlines likewise warned of phishing emails, fraudulent calls and websites impersonating its group, while saying the incident had no impact on its flight operations.

One Reservation Technology Provider, Multiple Airlines: What the Amadeus Incident Reveals

The disclosures show why the location of a breach matters. Malaysia Airlines says its internal systems remained secure, while information processed by its supplier may have been exposed. Assessing the incident therefore requires identifying the affected environment and the customer records accessible through it.

Amadeus' description of a display environment does not establish that its entire reservation infrastructure was compromised. Nor does Malaysia Airlines' affected processing period establish how long an intruder had access.

The unanswered questions concern which component was vulnerable, how access was controlled and which other customers used the same environment. Malaysia Airlines has promised further updates as its assessment continues.