{"version":"1.9","identifier":"2c56132f-7c80-41cb-9cba-f0c1a37f6e7f","language":"en-US","title":"A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed","layout":{"columns":7,"width":1024,"margin":32,"gutter":20},"componentLayouts":{"text":{"columnStart":0,"columnSpan":7,"maximumContentWidth":720,"margin":{"top":12,"bottom":12}},"photo":{"columnStart":0,"columnSpan":7,"margin":{"top":20,"bottom":20}}},"componentTextStyles":{"default":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"textColor":"#171717"},"headline":{"fontName":"HelveticaNeue-Bold","fontSize":36,"lineHeight":42,"conditional":[{"conditions":{"maxViewportWidth":480},"fontSize":28,"lineHeight":34}]},"intro":{"fontName":"HelveticaNeue","fontSize":20,"lineHeight":28,"textColor":"#555555"},"caption":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":19,"textColor":"#666666"},"byline":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":20,"textColor":"#666666"},"body":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"paragraphSpacingAfter":14,"linkStyle":{"textColor":"#00704a"}}},"metadata":{"canonicalURL":"https://www.loungefrog.com/news/amadeus-breach-thai-cathay-jal-singapore-airlines-passport-numbers-exposed","datePublished":"2026-11-10T14:24:35.943468Z","dateModified":"2026-11-10T14:25:19.535321Z","authors":["Patrick Karsh"],"excerpt":"About 250,000 booking records were accessed between August 2023 and September 2026. Airlines say card data was safe. Here is what was exposed and what to do.","thumbnailURL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/2c56132f-7c80-41cb-9cba-f0c1a37f6e7f/79e6d8491a59feee465b2c5fc82f27e1.jpg","keywords":["airline"],"generatorName":"Frog News","generatorVersion":"1.0"},"components":[{"role":"title","text":"A 3-year breach at Amadeus hit Thai, Cathay, JAL and SIA bookings. Some passport numbers were exposed","textStyle":"headline","layout":"text"},{"role":"intro","text":"About 250,000 booking records were accessed between August 2023 and September 2026. Airlines say card data was safe. Here is what was exposed and what to do.","textStyle":"intro","layout":"text"},{"role":"byline","text":"By Patrick Karsh · Published November 10, 2026","textStyle":"byline","layout":"text"},{"role":"photo","URL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/2c56132f-7c80-41cb-9cba-f0c1a37f6e7f/79e6d8491a59feee465b2c5fc82f27e1.jpg","caption":"The reception desk at Cathay Pacific's The Pier business lounge in Hong Kong. Cathay is one of the airlines affected by the Amadeus breach. · Cathay Pacific","accessibilityCaption":"The reception desk at Cathay Pacific's The Pier business lounge in Hong Kong. Cathay is one of the airlines affected by the Amadeus breach.","layout":"photo"},{"role":"caption","text":"The reception desk at Cathay Pacific's The Pier business lounge in Hong Kong. Cathay is one of the airlines affected by the Amadeus breach. · Cathay Pacific","textStyle":"caption","layout":"text"},{"role":"body","format":"markdown","text":"Four big Asian airlines now say an outsider got into their booking data through Amadeus, the travel tech firm that runs their reservation systems. Thai Airways, Cathay Pacific, Japan Airlines and Singapore Airlines have each disclosed the problem since late October. The access ran from August 2023 to September 2026, more than three years. Thai Airways posted its notice on Nov. 9, 2026.\n\nFor most affected travelers, the exposed data was a name, a booking code and trip details. A much smaller group may also have had contact details, passport numbers and frequent flyer numbers exposed. None of the airlines has found that card payment data was exposed.","textStyle":"body","layout":"text"},{"role":"body","format":"markdown","text":"## What was exposed, airline by airline\n\nThe airlines count the damage in slightly different ways. Thai counts passenger records, Cathay counts bookings, JAL counts customers and Singapore Airlines counts booking records. So the totals are close but not exact matches. Added together, the four disclosures cover about 250,000 records.","textStyle":"body","layout":"text"},{"role":"htmltable","html":"
AirlineAffectedWith extra details
Japan AirlinesAbout 92,000 customersAbout 2,000
Thai AirwaysAbout 60,529 recordsAbout 376
Cathay PacificAbout 53,000 bookingsSmaller subset, no number given
Singapore AirlinesAbout 46,000 recordsAbout 620
","layout":"text"},{"role":"body","format":"markdown","text":"**Bookings or customers affected by the Amadeus breach, by airline**\n\nAirlines count records, bookings or customers, so figures are approximate and not strictly comparable.","textStyle":"body","layout":"text"},{"role":"htmltable","html":"
AirlineAffected
Japan Airlines92,000
Thai Airways60,529
Cathay Pacific53,000
Singapore Airlines46,000
","layout":"text"},{"role":"body","format":"markdown","text":"Source: [Thai Airways](https://www.thaiairways.com/en-us/content/news-and-announcements/amadeus-reports-unauthorized-access-to-thai-passenger-data/), [Cathay Pacific](https://www.cathaypacific.com/cx/en_SG/latest-news/security-and-operational-changes/personal-data-security.html), [Japan Airlines](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html), [CNA on Singapore Airlines](https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151)\n\n**Thai Airways** says Amadeus told it about unauthorized access to booking data stored in Amadeus systems between Aug. 10, 2023, and Sept. 23, 2026. About 60,529 passenger records may have been accessed. They held names, booking codes, travel dates, routings and cabin class. About 376 records may also have held email addresses, phone numbers, passport numbers, nationality, frequent flyer numbers, ticket numbers and seat numbers. Read [Thai's notice](https://www.thaiairways.com/en-us/content/news-and-announcements/amadeus-reports-unauthorized-access-to-thai-passenger-data/).\n\n**Cathay Pacific** says Amadeus told it on Oct. 28, 2026, and sent more details the next day. Cathay says an unauthorized party used login credentials assigned to an Amadeus system account. About 53,000 Cathay bookings were affected. Most held booking codes, names and flight details. A smaller subset may have included email, phone, travel document or frequent flyer numbers. Read [Cathay's notice](https://www.cathaypacific.com/cx/en_SG/latest-news/security-and-operational-changes/personal-data-security.html).\n\n**Japan Airlines** says it learned of the problem on Oct. 23, 2026. The breach also covers its Japan Transocean Air unit. JAL says about 90,000 customers had booking codes, names, flight dates, routes and class of service accessed. About 2,000 more also had contact details, passport numbers, nationality and frequent flyer numbers exposed. Read [JAL's notice](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html).\n\n**Singapore Airlines** said in a Nov. 3 media statement that about 46,000 booking records were accessed, [CNA reported](https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151). For about 620 of them, email addresses, phone numbers, travel document details and KrisFlyer numbers may also have been accessed. SIA said its own systems were not breached.\n\n## What was not exposed\n\nThe airlines draw the same lines. Thai says credit card data was not affected. JAL says no credit card numbers or passwords were compromised. Cathay says there is no evidence that financial or payment data was accessed. CNA reported that Amadeus confirmed no bank or card data was exposed and no bookings were changed.\n\nEach airline also says its own systems and flights were not affected. Thai and Cathay say Amadeus revoked or reset the login credentials and added more monitoring. Cathay says Amadeus has found no evidence that the data has been misused.\n\n## What travelers should do now\n\nYou do not need to cancel a trip. But you should be careful with messages about your booking for a while.\n\n* **Expect a notice.** Thai and Cathay say they will contact affected passengers one by one. JAL says it has already emailed affected customers. SIA is contacting affected customers with upcoming travel to change their booking codes.\n* **Watch for fake messages.** JAL warns customers to watch for phishing emails, fake phone calls and copycat websites. A scammer who knows your name, route and booking code can sound very convincing.\n* **Never pay through a link in a message.** If an email says your flight needs a fee or a fix, open the airline's app or website yourself.\n* **Lock down your loyalty account.** Some records held frequent flyer numbers. Use a strong, unique password on your Cathay, JAL, KrisFlyer or Royal Orchid Plus account, and turn on extra login checks where offered.\n* **Check your passport details are safe.** If an airline tells you a travel document was in your record, follow its advice and contact your passport office if you are worried.\n\n## Our take: the booking code was never really secret\n\nMost travelers treat a six-character booking code as a throwaway. This breach is a good argument against that habit. With a name and a booking code, a stranger can often pull up a trip on an airline's website. That is why SIA's choice to issue new booking codes for upcoming travel makes sense.\n\nIt also shows how much of air travel runs on a few shared systems. Amadeus serves hundreds of airlines, according to Cathay. When one account at that kind of provider is misused, the risk spreads to many carriers at once. Other airlines, including Malaysia Airlines and Asiana Airlines, have also disclosed links to the incident, CNA reported. More notices may follow.\n\nIf you fly any of these airlines through hubs like [Hong Kong](https://www.loungefrog.com/airports/hkg), [Tokyo Haneda](https://www.loungefrog.com/airports/hnd), [Bangkok](https://www.loungefrog.com/airports/bkk) and [Singapore](https://www.loungefrog.com/airports/sin), the advice is simple. Read every booking email twice, and go straight to the airline when in doubt.","textStyle":"body","layout":"text"}]}