Malaysia Airlines said on Sunday that some of its customer information may have been affected by a cybersecurity incident at Amadeus, the Spanish travel technology company that provides its reservation systems. The disclosure makes the Malaysian flag carrier the latest airline to warn passengers over the breach, and it underlines how a single compromised supplier can expose booking data across an entire industry.
In its statement, Malaysia Airlines said the incident may have affected information processed between August 2023 and September 2026, a window of more than three years. The airline stressed that its own IT systems were not breached and that there was no evidence financial information had been accessed. It said it is working with Amadeus and other relevant parties to investigate the incident and assess its impact, and it urged customers to stay vigilant against suspicious or unsolicited messages, particularly any that ask for personal or financial information.
Malaysia Airlines joins a growing list of carriers that have disclosed in recent days. Cathay Pacific has reported that the breach involved data from about 53,000 bookings, Japan Airlines and Japan Transocean Air have put their figure at roughly 92,000 customers, and All Nippon Airways has reported about 37,800 customers. South Korea's Korean Air and Asiana Airlines and Japan's StarFlyer have also said customer data held by Amadeus was accessed. The figures cannot simply be added together, because the airlines count different things — bookings in some cases, individual customers in others — and Amadeus has not said how many airlines or travellers are affected in total.
For most affected passengers, the exposed records are booking details: a booking reference, the passenger's name, flight date, route and class of travel. A smaller subset goes further. Japan Airlines said that for about 2,000 of its customers the data also included contact details, passport numbers, nationality and frequent flyer numbers, and Cathay Pacific said a subset of its bookings likewise included contact details, travel document information or frequent flyer numbers. The airlines have consistently said that payment card numbers and passwords were not exposed.
According to the airline notices, the access involved login credentials associated with an Amadeus system account, rather than intrusions into each carrier's own network. Amadeus has said it became aware of a vulnerability affecting a travel booking display environment, and the airlines say credentials were reset and monitoring strengthened after the problem was found. Amadeus has not publicly put a total figure on the incident, and investigations are continuing.
The practical risk for travellers is not card fraud but targeted phishing: a booking reference, a real flight date and a route give a scammer everything needed to craft a convincing fake message about a genuine trip. That is why the airlines' advice to treat unexpected requests for personal or financial details with suspicion matters. For the industry, the incident is a sharp lesson in supplier risk — an airline can keep its own systems intact and still face a customer data breach, because the records sit in a shared reservation platform that much of global aviation depends on.