Cathay Pacific notice after Amadeus notification October 28, 2026; Qantas statement reported Monday, November 2, 2026; access window August 2023 to September 2026
The Amadeus Breach Keeps Growing: Qantas Is Checking, and the Access Ran for Three Years Before Anyone Noticed
The unauthorized access at Amadeus, the Spanish travel technology company whose systems handle reservations, ticketing and check-in for hundreds of airlines, now spans at least eight carriers that say booking data may have been exposed, plus one still checking. Cathay Pacific's own notice is the clearest primary record: Amadeus notified it on October 28, 2026 and gave further details on October 29; an unauthorized party used login credentials assigned to an Amadeus system account to reach reservation data between August 2023 and September 2026; about 53,000 Cathay bookings were affected, in most cases booking reference, passenger name and flight details, and in a smaller subset also email and phone contacts, travel document details or frequent flyer numbers. Cathay states there is no evidence financial or payment information was accessed, that Amadeus reset the password and added monitoring, that no misuse of the data has been identified to date, and that its own systems and operations were not affected. The wider tracker maintained by The Contrail adds the shape: Japan Airlines reports about 92,000 customers, with passport numbers among the details for about 2,000 of them; ANA reports about 37,800 passenger records; Korean Air, Asiana, StarFlyer and Malaysia Airlines have also said data may have been exposed, and Condor has reportedly confirmed it was affected. On Monday, November 2, Qantas said it is investigating whether its bookings were affected, that Amadeus told it the issue was contained in September, and that it has notified Australia's national cybersecurity agencies; Qantas has not confirmed that any of its records were accessed. Amadeus has published no list of affected airlines and no total count, and the figures that exist cannot be added together, because Cathay counts bookings while the Japanese carriers count customers.
Executives
One supplier's system account gave an outsider a three-year window into the booking records of airlines on three continents, and the vendor still has not published a total. That is the third-party risk lesson in its purest form: your exposure is set by a supplier's credential discipline and detection speed, not by your own perimeter. Boards should ask two questions of every critical supplier: how are system and service accounts controlled and monitored, and how quickly would we be told. Under the GDPR, the notification and documentation duties land on both sides of that contract, and this incident is now the worked example.
CIO / CISO
Treat any Amadeus-connected workflow as in scope for review: confirm what reservation data your organization sends, what comes back, and which of your own accounts and interfaces touch the platform. Press the vendor for the evidence behind the containment claim, including when the system account was reset and what monitoring was added, and log the answers in the vendor record. If your travelers or customers are in the affected set, prepare for the phishing pattern the airlines themselves warn about: messages that quote a real booking reference and ask for payment or passport details.
Engineers
The intrusion used assigned credentials, so it would look like legitimate access in most logs; that is the detection gap to close in your own estate. Inventory system and service accounts, flag any that can read bulk personal data, require phishing-resistant authentication or network restrictions where the platform allows it, and alert on first-time access patterns and bulk reads by service accounts. Long, quiet access windows are defeated by retention and review, not by perimeter tools.
Everyone (non-IT)
If you flew with Cathay Pacific, Japan Airlines, ANA, Korean Air, Asiana, Malaysia Airlines or the other named carriers between August 2023 and September 2026, your booking details may have been seen. No payment data is reported taken, and no misuse has been identified, but a name, booking reference and flight plan make convincing scam messages. Do not follow links in unexpected messages about a booking; open the airline's own app or type its address yourself, and never pay a fee or share passport details because a message asked.