A breach at travel technology provider Amadeus has spread to at least 15 airlines, with more than 230,000 customer and booking records exposed, after Singapore Airlines became the latest carrier to confirm it was affected. The incident is one of the widest third-party breaches the aviation industry has seen this year.

Singapore Airlines said on 3 November that 46,000 of its booking records were accessed. It joins Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air, Asiana Airlines, Jin Air and Malaysia Airlines on a growing list of carriers that have disclosed impact. Counting only the carriers that have published figures, the disclosed total already tops 230,000 records.

The airline-by-airline tally

Japan Airlines is the hardest hit so far, with about 92,000 customers affected, including Japan Transocean Air passengers. For roughly 90,000 of them, the exposed fields were reservation code, name, flight date, sector and class; for about 2,000 the data also included email, phone, passport number, nationality and frequent flyer number. Cathay Pacific reported around 53,000 bookings affected, mostly booking reference, passenger name and flight details, with a smaller subset that may include contact details, travel documents or frequent flyer numbers. All Nippon Airways reported about 37,800 customers, including about 1,700 whose extra personal details may have been exposed.

According to Cathay Pacific, an unauthorised party accessed travel reservation data inside Amadeus systems using login credentials assigned to an Amadeus system account. Amadeus has described the root cause as a vulnerability in its travel booking display environment. Japan Airlines says traces of outside access run from 10 August 2023 to 23 September 2026. None of the airlines' own systems were breached, and there is no evidence payment data was accessed. Amadeus notified Korean Air and Asiana on 20 October, Japan Airlines on 23 October and Cathay on 28 October.

Sources: The Cyber Express, Amadeus cybersecurity incident exposes data at 15 airlines, 5 November 2026; QUE.com, 4 November 2026; CNA via QUE.com.