If you booked a flight with Japan Airlines, ANA, Cathay Pacific, Korean Air, Asiana or another Amadeus-powered carrier between August 2023 and September 2026, your name, booking reference and itinerary may have been exposed. Some travelers also lost passport numbers, contact details and frequent flyer numbers. Card numbers and passwords were not taken, so focus on phishing and passport monitoring.
What Happened in the Amadeus Breach
Amadeus is the travel-technology company behind the reservation and passenger service systems used by more than 400 airlines, 210 airport operators and around 2 million hotels. On October 1, 2026, it published a statement saying it had found a vulnerability in a “display environment for travel bookings” after being alerted on September 21. At the time, Amadeus said payment and financial data could not be accessed and the flaw had been fixed.
Later in October, airlines began receiving breach notifications from Amadeus. Korean Air and Asiana were notified on October 20, Japan Airlines on October 23, and by October 30 at least seven carriers had disclosed customer impact. JAL and ANA both say the affected bookings were made between August 10, 2023 and September 23, 2026 — a window of more than three years.
Separately, German outlet heise reported on October 13 that an exposed application memory dump in an Amadeus environment contained credentials giving access to booking records for Lufthansa, Condor and partner-airline passengers, including names, dates of birth, passport data and contact details. Korean Air has said its incident involved misuse of login credentials assigned to an Amadeus system account. No source has yet confirmed whether the incidents are connected.
Which Airlines Are Affected
- Japan Airlines and Japan Transocean Air: about 92,000 customers — roughly 90,000 with basic booking data and about 2,000 with passport and contact details as well.
- All Nippon Airways (ANA): about 37,800 customers — roughly 36,100 basic and 1,700 with extended data.
- Cathay Pacific: about 53,000 bookings, with a smaller group including emails, phone numbers, travel documents and frequent flyer numbers.
- Korean Air and Asiana Airlines: booking reference numbers confirmed; wider personal data still under investigation; counts not published.
- Star Flyer: reservation data confirmed via ANA; scope not published.
- Lufthansa and Condor: passenger records were visible in the exposure heise reported; neither airline has published a count.
Because Amadeus serves hundreds of carriers and thousands of travel agencies, more disclosures are likely. The published figures mix customers and bookings and overlap, so they cannot simply be added together.
What Data Was Exposed
Most affected travelers: booking reference (PNR), full name, flight dates, routes and cabin class.
A smaller group: email address, phone number, passport number, nationality, frequent flyer number, ticket number and seat details.
Not exposed, per the airlines: credit card numbers and account passwords. JAL says it has found no evidence of misuse so far.
The Real Risk: Phishing With Your Real Itinerary
A PNR plus your name is enough to view or change many bookings on airline websites. Scammers who hold that data can send emails or texts quoting your real flight number, route and dates — “your flight has been cancelled, claim your refund here.” Treat any unexpected flight message as suspect, even when the details are correct.
Step 1: Confirm Whether You Are Affected
Check your email for notices from your airline, and read the official statement on the carrier's own website (type the address yourself). JAL, ANA and Cathay Pacific have published notices and are contacting affected customers directly. If you booked through a travel agency or online travel site, ask them which airline systems your booking passed through.
Step 2: Lock Down Your Upcoming Bookings
For any future trip booked in the exposure window, log into the airline's site and confirm nothing has changed — names, seats, contact email, or refund requests. Where the airline allows it, add a PIN or change the contact email on the booking. If you see a change you did not make, call the airline using the number on its official website.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 3: Secure Your Frequent Flyer Account
Passwords were not exposed, but frequent flyer numbers were for some travelers, and loyalty accounts are a favorite target for miles theft. Change your password, turn on two-factor authentication, and review recent redemptions. Our guide on recovering a hacked travel loyalty account covers what to do if miles are already missing.
Step 4: Protect Your Passport Number
If your notice says your passport number was exposed, you cannot simply change it the way you change a password. Watch for identity-verification abuse, and consider whether to replace the passport if you see signs of misuse. Our walkthrough on what to do if your passport information is stolen explains when replacement makes sense. Travelers on Vietnam routes should also check the earlier APIS airline passenger data breach, which exposed similar passport data.
Step 5: Shrink the Rest of Your Exposed Footprint
Breached booking data becomes far more dangerous when criminals can match it to your home address, relatives and phone number from people-search sites. A scammer who knows your itinerary and your address knows when your house is empty. Removing yourself from data brokers cuts that link. You can file opt-outs by hand, or compare the best data removal services — PrivacyOn removes you from 100+ brokers, monitors the dark web 24/7 for your email, phone and passport details, and covers up to 5 family members from $8.33/month.
Fast Checklist
Read your airline's official notice. Verify future bookings. Change your frequent flyer password and enable 2FA. Ignore unsolicited “refund” links, even with correct flight details. Watch for passport misuse. Remove your address and phone number from people-search sites.
How to Spot Amadeus Breach Scams
- Refund and compensation offers that ask you to click a link or enter card details.
- Fake “rebooking” calls from someone who already knows your flight number.
- Passport “verification” requests asking you to upload a photo of your passport.
- Lookalike airline domains in emails — check the sender carefully.
For more warning signs, see our guide to recognizing and avoiding phishing scams.
Protect Yourself Before the Next Breach
Travel-industry breaches keep coming because a single vendor like Amadeus holds data for hundreds of airlines at once. You cannot control which systems your booking passes through, but you can control how much of the rest of your life is public. Run a free PrivacyOn scan to see which data brokers are publishing your address and phone number right now, and get alerted the moment your details show up in a new breach dump.
Frequently Asked Questions
Was my credit card exposed in the Amadeus breach?
According to Amadeus and the airlines that have disclosed so far, no. JAL, ANA and Asiana say payment information was not included, and Cathay Pacific reports no evidence that payment data was accessed. Still review your card statements, because scammers may use the booking data to trick you into handing card details over.
Which airlines were affected by the Amadeus data breach?
As of October 30, 2026: Japan Airlines, Japan Transocean Air, ANA, Star Flyer, Cathay Pacific, Korean Air and Asiana Airlines have disclosed impact, and heise reported exposed records for Lufthansa and Condor passengers. Amadeus works with more than 400 airlines, so others may follow.
What is a PNR and why does it matter?
A PNR (passenger name record), also called a booking reference or confirmation code, is the six-character code tied to your reservation. Combined with your last name, it often lets anyone view, change or cancel a booking online, which is why you should check upcoming trips and add extra protection where the airline allows it.
Should I replace my passport after the Amadeus breach?
Only a small share of travelers had passport numbers exposed, and your airline notice will say if you are one of them. A passport number alone is hard to misuse, so most people monitor rather than replace. Replace it if you see signs of fraud or if you travel to countries where identity documents are commonly abused.
How do I know if a message about the Amadeus breach is real?
Never act on a link in the message. Go directly to the airline's website or app by typing the address yourself, and check for a breach notice there. Legitimate airlines will not ask you to send passport photos or card details by email to process a breach-related refund.
What is the best way to protect my data after an airline breach?
Secure the accounts tied to the breach, then reduce your wider exposure. PrivacyOn removes your address, phone number and relatives from 100+ data broker and people-search sites, and its 24/7 dark web monitoring alerts you if your email, phone or passport details appear in new leaks. Plans start at $8.33/month and cover up to 5 people.