Qantas has said it may have been affected by a data breach at global travel technology provider Amadeus, after the company advised the airline that there had been unauthorised access to one of its systems.

A Qantas spokesperson said Amadeus had advised that the issue was contained in September, and that Qantas was working with the provider to understand the impact on any Qantas bookings. The airline stressed there was no impact to its own systems or databases, which remain secure, and said it had notified the Australian Cyber Security Centre and the Office of National Cyber Security.

Other airlines confirm bookings affected

Cathay Pacific said around 53,000 of its bookings were affected by unauthorised access in Amadeus's system between August 2023 and September 2026. In most cases the data included booking reference, passenger name and flight details, while a smaller subset may also have included email and phone contacts, travel document numbers or frequent flyer numbers.

Japan Airlines said around 92,000 passengers were affected, and Malaysia Airlines said it was also assessing the impact with Amadeus. Amadeus, which services around 141 airlines, has reportedly advised clients that no payment or financial data was accessed, and says it has found no evidence so far that the affected data has been misused.

Separate from last year's Qantas breach

The reports are unrelated to a separate breach of Qantas itself last year, in which customer data was stolen in an attack on one of its call centres. Travellers who booked through affected airlines should watch for official contact from their carrier rather than acting on unsolicited messages claiming to relate to the incident.

Sources: Australian Aviation, 2 November 2026; Insurance Business, 2 November 2026.