A new data breach at global technology company Amadeus exposed customer information from multiple major airlines due to an unauthorised access vulnerability. Amadeus provides reservation and ticket distribution systems used by hundreds of carriers worldwide.
Data breach affects Qantas and major airlines
The breach that has affected multiple airlines in the Asia-Pacific region has also affected Australian air carrier Qantas; this has led to the carrier alerting the Australian Cyber Security Centre and Office of National Cyber Security, starting an enquiry into the incident. Other airlines that have been most affected are Japan Airlines, Asiana, ANA, Korean Air and Cathay Pacific.
The timeline of the security breach spans from August 2023 to September 2026, leaving a large amount of customer information exposed.
Qantas has had a long-term partnership with Amadeus, with their first agreement signed in 2003; this has since evolved with various extensions and agreements that have developed their collaboration. A joint distribution deal that was made meant that the carrier would ensure that Amadeus travel sellers had access to Qantas fares and products, delivering a better travel experience for both parties.
Amadeus’s NDC system was also decidedly included in the agreement, which aimed to benefit the airline by delivering more options and flexibility when providing content.
Amadeus made a statement on the breach, affirming that information accessed was not used for ransomware purposes,
“Amadeus became aware of a vulnerability affecting a travel booking display environment. Certain booking-display data was accessible through the vulnerability. Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed. There are no indications that this vulnerability has been exploited for ransomware purposes.”
Qantas Airways security
The air carrier faced a large unrelated data breach last year in 2025, which ended in 5.7 million records being stolen and a near fine of $7 billion. The records included personal information such as names, contact details, birth dates and email addresses; since then, the airline has enhanced security measures such as amplifying employee training and reinforcing system monitoring.
Despite the security attack on Amadeus’s systems, Qantas has stated its own systems remain secure and that they are investigating what specific information was accessed.
Has an airline cybersecurity breach ever affected you? Let us know in the comments!
