By Hamza Faisal
Malaysia Airlines has warned customers that some of their personal information may have been exposed in a cybersecurity incident at Amadeus, the third-party technology provider that runs its airline reservation system. The carrier said the incident may have affected customer information processed through Amadeus between August 2023 and September 2026, a window of roughly three years.
The airline stressed that its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It did not say how many customers may be affected or what types of personal data were involved, and it urged customers to stay alert to suspicious or unsolicited communications, especially messages asking for personal or financial details — a common follow-on tactic after breaches.
A three-year window
Malaysia Airlines said it is treating the matter with the utmost seriousness and is working closely with Amadeus and relevant parties to investigate the incident and assess its impact, promising further updates. Amadeus, for its part, has said it became aware of a vulnerability affecting a travel booking display environment. The company says it has taken actions to contain the incident, including a password reset and enhanced monitoring and detection on its systems, and that it has not identified evidence that the affected data has been misused. It has not said how many customers’ data were affected in total.
The long window is what makes this breach unusual. Traces of external access were identified between August 10, 2023 and September 23, 2026, according to disclosures from affected airlines — meaning booking records sat exposed for years before the intrusion was fully mapped. For passengers, that long exposure is the reason airlines are warning about phishing now, even though the access itself ended in September.
The toll keeps growing
Malaysia Airlines is the latest in a string of Asian carriers to disclose exposure in recent days. On October 30, Cathay Pacific said about 53,000 of its bookings were affected. In most cases the information accessed included booking references, passenger names and flight details, while in a smaller subset additional personal information — including email and phone contacts, travel document details and frequent flyer numbers — may also have been accessed. Cathay said there was no evidence that financial or payment information was accessed, and that its own systems and flight operations were unaffected.
Japan Airlines and Japan Transocean Air reported that about 92,000 customers were affected, while All Nippon Airways said information relating to about 37,800 customers had been accessed. South Korea’s Korean Air and Asiana Airlines disclosed unauthorised access to customer reservation information through Amadeus earlier in October, a development Paktechstan reported at the time, and smaller carriers including Star Flyer have also been named among those affected.
Why one vendor breach spreads so far
Amadeus is one of the world’s largest providers of reservation and distribution technology to airlines and travel agencies, supplying the passenger service systems that handle reservations, ticketing and check-in for hundreds of carriers. When a single shared system is breached, one intrusion can ripple across many airlines at once — and passengers often first hear about it from their own carrier rather than from the vendor.
For now, the picture remains incomplete: no airline has reported evidence that the exposed data has been misused, and no financial information is known to have been accessed. But with the affected window stretching back more than three years, the airlines’ shared advice is the same — treat unexpected messages asking for personal or payment details with suspicion, and wait for the carriers’ promised updates as the investigation continues.
