Qantas Investigates Possible Booking Data Exposure in Amadeus Breach

SYDNEY — Qantas (QF) is investigating whether its booking records were affected by unauthorized access to a system operated by travel technology provider Amadeus, according to a statement reported by *Australian Aviation* on November 2.

The airline said Amadeus had advised that the issue was contained in September. Qantas said its own systems and databases remain secure and that it is working with the supplier to establish the impact on any Qantas bookings. The publication also reported that Qantas had notified the Australian Cyber Security Centre and the Office of National Cybersecurity.

The statement does not confirm that Qantas passenger records were accessed. It follows Malaysia Airlines’ (MH) warning of possible customer information exposure, covered by Airways on November 1.

What Other Airlines Have Disclosed

Cathay Pacific’s (CX) October 30 notice identifies around 53,000 affected bookings. Most involved booking references, passenger names and flight details; a smaller subset potentially included contact details, travel-document information or frequent flyer numbers. Cathay said there was no evidence financial or payment information had been accessed.

All Nippon Airways’ (NH) notice identifies approximately 37,800 customers. About 36,100 potentially had names, booking references, travel dates, routes and cabin classes compromised. Another 1,700 potentially had additional information exposed, including passport numbers, nationality and contact details. ANA said credit card numbers and account passwords were not involved.

Japan Airlines (JL) and Japan Transocean Air (NU) identified approximately 92,000 affected customers. Their notice says Amadeus supplies a passenger service system integrating reservations, ticketing and check-in, and that traces of external access were found in some reservation records.

These disclosures measure different things: Cathay counts bookings, while the Japanese notices count customers. Adding the figures would not establish a reliable total of individual passengers affected across airlines.

Analysis: One Technology Provider, Many Airlines

The shared dependency is reservation information processed through Amadeus. Malaysia Airlines describes Amadeus as its reservation technology provider, while ANA and the two Japanese carriers identify it as their passenger service system provider. Those relationships establish a common supplier, but do not show that every carrier used the same affected application or account.

In our upcoming episode of The Airways Podcast, Tim McMullen, DataArt’s vice president of business development for aviation and travel technology, describes a reservation system operating alongside a newer loyalty platform and a mobile app. His discussion concerns airline technology generally, rather than the Amadeus incident. DataArt lists Amadeus among its technology partners.

A reservation platform can support bookings while a separate interface displays information from those records. Reuters reported that Amadeus identified a vulnerability in a travel-booking display environment. That description does not establish a compromise of every reservation, ticketing or check-in component.

Cathay provides a narrower account of the access route: an unauthorized party used credentials assigned to a system account to reach reservation data in Amadeus’s systems. It says its own systems and operations were unaffected. The exposure therefore illustrates how passenger information held by a supplier can be accessed without an intrusion into an airline’s internal systems.

The unresolved issue is the boundary of that account’s access: which records it could retrieve, which fields it could display and how access to different airlines’ information was restricted. The notices reviewed do not establish whether the account belonged to a person or an automated service, how its credentials were compromised, or whether the intruder could alter records. Reading booking information and changing a reservation are different capabilities; the disclosures cited here establish no basis for claiming the latter.

McMullen also raised the governance question in the podcast: “who is passing that data to whom, who owns it, who is securing it.” He advocated sharing the right amount of information with the appropriate party, supported by rules governing its use and retention. The account’s permitted access and the records actually viewed remain separate questions for the Amadeus investigation.

For passengers, the disclosed fields also explain why the response extends beyond payment-card security. ANA warns of phishing messages, calls and websites impersonating its group. As an analytical inference, accurate booking details could make an impersonation attempt more convincing; that risk does not establish that the exposed information has been used in fraud.

For Qantas, the immediate question remains whether any of its records were accessible through the affected environment. Other airlines’ findings cannot establish which Qantas passengers, if any, were exposed.