A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed

Four big Asian airlines now say an outsider got into their booking data through Amadeus, the travel tech firm that runs their reservation systems. Thai Airways, Cathay Pacific, Japan Airlines and Singapore Airlines have each disclosed the problem since late October. The access ran from August 2023 to September 2026, more than three years. Thai Airways posted its notice on Nov. 9, 2026.

For most affected travelers, the exposed data was a name, a booking code and trip details. A much smaller group may also have had contact details, passport numbers and frequent flyer numbers exposed. None of the airlines has found that card payment data was exposed.

What was exposed, airline by airline#

The airlines count the damage in slightly different ways. Thai counts passenger records, Cathay counts bookings, JAL counts customers and Singapore Airlines counts booking records. So the totals are close but not exact matches. Added together, the four disclosures cover about 250,000 records.

Japan Airlines

92,000

Thai Airways

60,529

Cathay Pacific

53,000

Singapore Airlines

46,000

Source: Thai Airways, Cathay Pacific, Japan Airlines, CNA on Singapore Airlines

Show the numbers

Airline	Affected
Japan Airlines	92,000
Thai Airways	60,529
Cathay Pacific	53,000
Singapore Airlines	46,000

Thai Airways says Amadeus told it about unauthorized access to booking data stored in Amadeus systems between Aug. 10, 2023, and Sept. 23, 2026. About 60,529 passenger records may have been accessed. They held names, booking codes, travel dates, routings and cabin class. About 376 records may also have held email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers, ticket numbers and seat numbers. Read Thai's notice.

Cathay Pacific says Amadeus told it on Oct. 28, 2026, and sent more details the next day. Cathay says an unauthorized party used login credentials assigned to an Amadeus system account. About 53,000 Cathay bookings were affected. Most held booking codes, names and flight details. A smaller subset may have included email, phone, travel document or frequent flyer numbers. Read Cathay's notice.

Japan Airlines says it learned of the problem on Oct. 23, 2026. The breach also covers its Japan Transocean Air unit. JAL says about 90,000 customers had booking codes, names, flight dates, routes and class of service accessed. About 2,000 more also had contact details, passport numbers, nationality and frequent flyer numbers exposed. Read JAL's notice.

Singapore Airlines said in a Nov. 3 media statement that about 46,000 booking records were accessed, CNA reported. For about 620 of them, email addresses, phone numbers, travel document details and KrisFlyer numbers may also have been accessed. SIA said its own systems were not breached.

What was not exposed#

The airlines draw the same lines. Thai says credit card data was not affected. JAL says no credit card numbers or passwords were compromised. Cathay says there is no evidence that financial or payment data was accessed. CNA reported that Amadeus confirmed no bank or card data was exposed and no bookings were changed.

Each airline also says its own systems and flights were not affected. Thai and Cathay say Amadeus revoked or reset the login credentials and added more monitoring. Cathay says Amadeus has found no evidence that the data has been misused.

What travelers should do now#

You do not need to cancel a trip. But you should be careful with messages about your booking for a while.

• Expect a notice. Thai and Cathay say they will contact affected passengers one by one. JAL says it has already emailed affected customers. SIA is contacting affected customers with upcoming travel to change their booking codes.
• Watch for fake messages. JAL warns customers to watch for phishing emails, fake phone calls and copycat websites. A scammer who knows your name, route and booking code can sound very convincing.
• Never pay through a link in a message. If an email says your flight needs a fee or a fix, open the airline's app or website yourself.
• Lock down your loyalty account. Some records held frequent flyer numbers. Use a strong, unique password on your Cathay, JAL, KrisFlyer or Royal Orchid Plus account, and turn on extra login checks where offered.
• Check your passport details are safe. If an airline tells you a travel document was in your record, follow its advice and contact your passport office if you are worried.

Our take: the booking code was never really secret#

Most travelers treat a six-character booking code as a throwaway. This breach is a good argument against that habit. With a name and a booking code, a stranger can often pull up a trip on an airline's website. That is why SIA's choice to issue new booking codes for upcoming travel makes sense.

It also shows how much of air travel runs on a few shared systems. Amadeus serves hundreds of airlines, according to Cathay. When one account at that kind of provider is misused, the risk spreads to many carriers at once. Other airlines, including Malaysia Airlines and Asiana Airlines, have also disclosed links to the incident, CNA reported. More notices may follow.

If you fly any of these airlines through hubs like Hong Kong, Tokyo Haneda, Bangkok and Singapore, the advice is simple. Read every booking email twice, and go straight to the airline when in doubt.

{{cite news |title=A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed |url=https://www.loungefrog.com/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed |work=Lounge Frog |author=Patrick Karsh |date=2026-11-10 |language=en}}

{
  "id": "https://www.loungefrog.com/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed",
  "type": "article-newspaper",
  "title": "A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed",
  "URL": "https://www.loungefrog.com/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed",
  "container-title": "Lounge Frog",
  "language": "en",
  "author": [
    {
      "literal": "Patrick Karsh"
    }
  ],
  "issued": {
    "date-parts": [
      [
        2026,
        11,
        10
      ]
    ]
  }
}

<iframe src="https://www.loungefrog.com/embed/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed?theme=auto" title="A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed by Lounge Frog" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe>
<p style="font-size:14px">A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed by <a href="https://www.loungefrog.com/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed" rel="nofollow">Lounge Frog</a></p>
<script async src="https://www.loungefrog.com/embed.js"></script>