Malaysia Airlines joins Cathay Pacific, Japan Airlines and other carriers affected by unauthorized access to a shared reservation technology provider, raising concerns over third-party cybersecurity risks in aviation.
Malaysia Airlines has become the latest major carrier to disclose potential customer data exposure linked to a cybersecurity incident at Amadeus, the Spanish technology provider supporting airline reservations worldwide.
According to Reuters, the Malaysian flag carrier joins Cathay Pacific, Japan Airlines and South Korea’s Asiana Airlines among carriers reporting that customer information was compromised.
The incident involves reservation information processed between August 2023 and September 2026. While the full impact remains under investigation, disclosures from affected airlines reveal a wider security problem involving shared aviation technology infrastructure.
Multiple Airlines Report Customer Data Exposure
In its October 31 security statement, Malaysia Airlines acknowledged that customer information processed through Amadeus may have been affected.
The airline emphasized that its internal IT systems were not compromised and that there was no evidence of unauthorized access to financial information.
However, it did not disclose the number of potentially affected customers or specify the categories of personal information involved.
The incident follows similar disclosures across Asia.
The Straits Times other affected carriers include All Nippon Airways (ANA), Korean Air and German airline Condor.
The growing list illustrates how a security incident involving one widely used technology provider can affect multiple airlines without necessarily compromising their individual systems.
Passenger Names, Booking Details and Passport Data
Cathay Pacific confirmed that approximately 53,000 bookings were affected by unauthorized access to reservation data held by Amadeus.
Its October 30 disclosure identified booking references, passenger names and flight details among the accessed records. A smaller subset potentially included contact information, travel documents and frequent-flyer numbers.
Japan Airlines reported approximately 92,000 affected customers, including 2,000 whose exposed information extended to passport numbers, nationalities, contact details and other reservation records.
According to Japan Airlines’ official notice, credit card numbers and passwords were not compromised, and flight operations remained unaffected.
Meanwhile, ANA confirmed approximately 37,800 affected customers, including 1,700 whose potentially accessed records contained additional personal information.
The disclosed figures represent different measures—customer records and bookings—and should not be interpreted as a consolidated count of unique affected passengers.
Amadeus Implements Security Measures
Reuters reported that Amadeus identified a vulnerability involving a travel booking display environment, although the company did not disclose the total number of affected customers.
Cathay Pacific said an unauthorized party accessed reservation records using login credentials assigned to an Amadeus system account.
According to the airline, Amadeus subsequently reset a password and strengthened its monitoring and detection capabilities.
The provider had not identified evidence that the affected information had been misused, while Cathay confirmed that its own systems and operations were unaffected.
Third-Party Security Becomes an Aviation Industry Concern
The breach highlights the cybersecurity risks created when airlines depend on shared reservation and passenger-service platforms.
These systems support essential activities such as booking, ticketing and check-in, making their security important beyond any individual airline.
Even without exposed payment information, passenger names, itineraries and booking references could potentially support convincing impersonation or targeted phishing attempts. No such misuse has been established in the disclosed incidents.
Affected airlines have advised customers to remain alert to suspicious communications.
For aviation technology developers and cybersecurity teams, the incident underscores the importance of credential security, access restrictions, continuous monitoring and coordinated incident response across suppliers and customers.
The broader lesson is that airlines can protect their internal networks yet remain exposed through the technology providers connecting the global aviation industry.
