Jake Nelson 
Amadeus, which services around 141 global airlines, including Korean Air, Asiana, Japan Airlines, ANA, and Cathay Pacific, has reportedly advised its clients that no payment or financial data was accessed, though other personal details may have been exposed.
The Flying Kangaroo has notified the Australian Cyber Security Centre and the National Office of Cyber Security of the breach.
“We have been advised by global travel technology provider Amadeus that there has been unauthorised access to one of their systems,” a Qantas spokesman said.
“Amadeus advised the issue was contained in September and we’re working with them to understand the impact to any Qantas bookings. There is no impact to Qantas systems or databases which remain secure.”
Cathay Pacific is among the airlines that have confirmed they were impacted, with the Hong Kong carrier saying, “around 53,000 bookings relating to Cathay Pacific were affected by the unauthorised access in Amadeus’ system, which occurred between August 2023 and September 2026”.
“In the majority of cases, the information accessed included booking reference, passenger name and flight details,” the airline said.
“In a smaller subset of cases, additional personal information including but not limited to email and phone contacts, travel document and/or frequent flyer number were potentially accessed. However, there is no evidence that financial or payment information was accessed.
“Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus has not identified evidence that the affected data has been misused.”
Both Malaysia Airlines and Japan Airlines (JAL) have issued statements detailing their exposure to the breach, with JAL saying around 92,000 passengers were affected and Malaysia Airlines saying it is also working with Amadeus to assess the impact.
The reports are unrelated to a data breach Qantas itself suffered last year, which saw customer data, including names, email addresses, phone numbers, birth dates, and frequent flyer numbers, stolen in a cyber attack against one of its call centres.
The Office of the Australian Information Commissioner determined in July that there was nothing to suggest Qantas had not done its part to protect its customers, saying it had not failed to take reasonable steps to protect its customers’ data, and that its response afterwards had reduced the impact.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.