Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems.
The disclosure adds to a wave of airline cyberattacks that has now hit at least 15 carriers across Asia, Europe and Australia, and it highlights how cyberattacks on airlines reach passengers through shared third-party platforms rather than airlines’ own networks.
What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident
SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers’ names, booking reference numbers, travel itineraries and booking classes.
A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed.
The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers.
Cathay Pacific: 53,000 Bookings Accessed Over Three Years
Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October.
According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus’s systems “using login credentials assigned to its system account.” Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026.
In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched.
The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused.
Cathay stressed that the incident “has not impacted and is not impacting” its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. “We apologise to our customers for the concern and inconvenience caused by this incident,” the airline said.
Malaysia Airlines Urges Vigilance
Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected.
The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact.
As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, “particularly those requesting personal or financial information.” The carrier said it would share further updates as more information emerges.
Japanese and Korean Carriers Report Similar Airline Cyberattacks
Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed.
Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached.
How Amadeus Explains the Breach
Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific’s account, which describes an unauthorized party using system account login credentials.
The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures.
The Full Reach of These Cyberattacks on Airlines
At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them.
Major carriers with confirmed exposure
| Airline | Reported impact |
| Japan Airlines (JAL) | About 92,000 passenger records |
| Cathay Pacific Airways | About 53,000 passenger bookings |
| Singapore Airlines (SIA) | About 46,000 booking records |
| All Nippon Airways (ANA) | Up to 37,800 customer profiles |
| Malaysia Airlines | Customer data exposed across August 2023 to September 2026 |
| Korean Air | Unauthorised access to customer reservation databases |
| Asiana Airlines | Passenger booking references exposed through system account credentials |
| Condor Airlines | Part of the German leisure carrier’s international flight data accessed |
Regional and subsidiary carriers
Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups:
| Airline | Link to the breach |
| Japan Transocean Air (JTA) | Affected through parent company Japan Airlines |
| Air Do | Affected through shared system pathways with ANA |
| StarFlyer | Affected through shared system pathways with ANA |
| Solaseed Air | Affected through shared system pathways with ANA |
| Ibex Airlines | Still determining the scope of exposure via its ANA integration |
| Oriental Air Bridge | Still determining the scope of exposure via its ANA integration |
Under investigation
Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached.
What the Amadeus Cybersecurity Incident Means for Travelers?
With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken.
Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references.
As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached.
