Qantas Amadeus Data Breach 2026: What We Know About the Airline Cyberattack

Qantas is investigating whether passenger booking information was exposed in a cyberattack involving global travel technology provider Amadeus. Other international airlines have already confirmed affected customer records, with evidence of unauthorised access dating back to August 2023.

Australian airline Qantas has become the latest major carrier drawn into a cybersecurity incident involving Amadeus, the Spanish technology company whose systems support airline reservations and passenger services worldwide.

The incident has already affected reservation information associated with Japan Airlines, All Nippon Airways (ANA) and Cathay Pacific. JAL and ANA disclosures together describe approximately 130,000 customers, while Cathay Pacific identifies around 53,000 bookings. These are separate reported figures, not a verified total of unique affected passengers.

Australian Aviation reported on 2 November 2026 that Qantas had been notified by Amadeus of unauthorised access to one of the provider's systems. The airline is investigating whether any Qantas bookings were affected.

The case highlights a significant challenge for organisations that depend on external technology providers: a company's internal systems can remain secure while sensitive customer information held by a supplier is exposed.

Featured illustration: a conceptual travel-booking ecosystem. The unbranded hotels do not represent confirmed hotel exposure in this incident.

What happened in the Qantas Amadeus cyberattack?

Amadeus provides reservation and passenger-service technology to airlines and other travel businesses worldwide.

In its October 2026 statement, the company acknowledged a vulnerability affecting a travel-booking display environment. Certain booking-display information had been accessible through that vulnerability.

Amadeus said it had implemented corrective measures and strengthened its monitoring and detection capabilities.

Meanwhile, airline disclosures provide further details about unauthorised access to passenger reservation records.

Cathay Pacific reported on 30 October that an unauthorised party had used login credentials assigned to an Amadeus system account to access reservation information.

The full technical relationship between the reported vulnerability and the compromised credentials has not been publicly established.

What has Qantas confirmed?

A Qantas spokesperson told Australian Aviation that Amadeus had advised it the issue was contained in September. Qantas said it was working with the provider to establish any impact on its bookings.

Qantas also confirmed that its own systems and databases had not been affected.

Australian Aviation also reports that the airline notified the Australian Cyber Security Centre and the Office of National Cyber Security.

As of 4 November 2026, Qantas has not publicly confirmed how many, if any, of its passenger records were accessed.

That distinction matters. Confirmed exposure involving other airlines does not automatically establish that Qantas passenger information was compromised.

A potential three-year security exposure

One of the most concerning aspects of the incident is the period during which evidence of unauthorised access has been identified.

Japan Airlines reported traces of external access between 10 August 2023 and 23 September 2026. ANA separately identifies customers who made reservations during those dates; that reservation period should not be mistaken for an independent finding of continuous attacker access.

Cathay Pacific separately identified unauthorised access affecting bookings between August 2023 and September 2026.

This represents an exposure window extending over approximately three years.

However, it does not necessarily establish that an attacker maintained uninterrupted access throughout that period. Nor does it establish precisely when the initial compromise occurred.

Nevertheless, the timeline raises important questions about how suspicious activity was detected, how access permissions were monitored and whether existing security controls were sufficient.

Which airlines and passengers have been affected?

Several international airlines have reported exposure involving Amadeus reservation information.

The figures reflect the airlines' respective disclosures. A booking can involve multiple passengers, and an individual may hold more than one booking.

Consequently, adding the reported numbers together would not produce a reliable count of affected individuals.

Further airline notifications could change the overall picture.

What passenger information was exposed?

The information identified in confirmed airline disclosures includes:

• Passenger names
• Passenger name records (PNRs) and booking references
• Flight dates and travel routes
• Cabin classes and seat numbers
• Email addresses and telephone numbers
• Passport numbers and nationalities
• Frequent flyer identifiers
• Ticket and flight numbers

Not every affected passenger had all these details exposed.

Japan Airlines reported that approximately 90,000 customers had basic reservation information accessed, while around 2,000 had additional personal details exposed.

ANA's 30 October disclosure reported a similar distinction between approximately 36,100 customers whose basic booking information was potentially compromised and another 1,700 whose additional personal information may have been accessed.

Amadeus says there is no evidence that payment or financial information was accessed. JAL and ANA specifically state that credit card numbers and passwords were not involved; this should not be generalised into a separate finding about every airline.

This is reassuring, but it does not eliminate the potential security consequences.

Why airline booking data is valuable to cybercriminals

A passenger name record can contain considerably more useful information than many travellers realise.

A booking reference, passenger name and itinerary may provide enough context to make a fraudulent communication appear credible.

For example, an attacker possessing genuine travel details could potentially send a convincing message claiming that a passenger needs to verify a booking, pay an additional charge or confirm travel-document information.

Such messages are more persuasive when they reference an actual flight, destination or departure date.

This creates opportunities for highly targeted phishing and social-engineering attacks.

The JAL and Cathay disclosures report no evidence of misuse at the time of their statements. That is a dated assessment, rather than proof that misuse cannot occur. Several affected airlines have warned customers to remain vigilant.

Could criminals access or change bookings?

The answer depends on the permissions and controls of the relevant airline reservation system.

Some airline booking-management processes use passenger names and booking references to retrieve itinerary information.

However, possession of those details does not automatically establish the ability to change flights, obtain payment information or access frequent flyer accounts.

The public disclosures do not demonstrate that attackers modified reservations or obtained those additional capabilities.

Passengers should nevertheless treat unexpected requests involving genuine booking information with caution.

The bigger cybersecurity issue: third-party supply-chain risk

The most important lesson from the Amadeus incident extends far beyond aviation.

Modern businesses rarely maintain complete control over every system processing their customers' information.

Instead, they depend on external suppliers for services such as:

• Cloud hosting and managed infrastructure
• Customer relationship management platforms
• Online booking and reservation systems
• Email and communications services
• Payment processing
• Accounting and business administration

Each relationship introduces an additional dependency. My article on outsourced IT and third-party cyber security risk examines how to establish what a provider actually protects and who checks it.

A business may maintain strong authentication, current software patches, properly configured firewalls and effective internal monitoring.

Yet its customers' information may still be exposed through a supplier's systems.

The security of customer data is therefore determined partly by controls outside the organisation that collected it.

The problem of shared infrastructure

The Amadeus case illustrates the potential consequences of technology platforms serving multiple organisations.

Shared systems can provide operational efficiency, scalability and integration. However, they also create concentration risk.

If a vulnerability or compromised account provides access to information belonging to multiple customers of a service provider, the consequences can extend across numerous otherwise independent organisations.

An important unanswered question in this incident concerns the scope of the affected Amadeus account's access.

Specifically, investigators will need to establish which reservation records the account could retrieve, how its permissions were restricted and whether access controls adequately separated information belonging to different airlines.

The publicly available evidence does not yet establish the answers.

What does the compromised system account tell us?

Cathay Pacific's disclosure identifies unauthorised use of login credentials assigned to an Amadeus system account.

This is particularly significant from an identity and access management perspective.

Accounts used by systems can support automated processes, integrations and application-to-application communication. However, Cathay's wording does not establish that this particular account was an automated service account or a non-human identity.

Depending on their configuration, they may possess permissions that differ considerably from those assigned to ordinary employees.

If credentials are compromised, an attacker may be able to perform actions authorised for that account.

The precise permissions and nature of the account described in the disclosure have not been publicly disclosed.

Nor has the original method of credential compromise been confirmed.

It would therefore be premature to attribute the incident to phishing, malware, an exposed API secret or any other particular technique.

Nevertheless, the incident highlights why organisations should regularly review privileged and non-human identities.

Relevant controls include narrowly scoped permissions, secure credential storage, credential rotation, short-lived authentication tokens where supported and monitoring for unusual access patterns.

Security teams should also investigate whether service accounts can retrieve information beyond the minimum required for their intended functions. My system isolation and segmentation article discusses limiting what a compromised identity or system can reach.

Why detecting unusual access matters

The reported access window extending from 2023 to 2026 raises a further question: how quickly should suspicious activity involving sensitive customer information be detected?

Modern security monitoring should consider more than failed login attempts.

Potential warning signs include unusual data retrieval volumes, access from unexpected locations, activity outside established operational patterns and accounts requesting information unrelated to their normal functions.

These signals do not necessarily prove malicious activity. Legitimate operational changes can produce similar patterns.

However, properly configured monitoring and investigation processes can help organisations identify activity that warrants closer examination.

It remains unclear which monitoring controls were operating within the affected Amadeus environment or when suspicious activity was first detected.

Without those details, it would be inappropriate to conclude that a particular security control failed.

The length of the reported access-trace period nevertheless makes detection capability a central issue for the continuing investigation. The Mathspace incident-response article explains why remediation and investigation of earlier access are separate jobs.

Is this connected to the 2025 Qantas data breach?

No confirmed connection has been established.

In July 2025, Qantas disclosed a separate cybersecurity incident involving a third-party customer-servicing platform accessed through one of its contact centres.

That incident resulted in the compromise of customer information and subsequently became the subject of further developments.

The 2026 Amadeus incident concerns a different external technology provider and airline reservation information.

Although both cases involve third-party dependencies, they should be treated as separate incidents unless evidence establishes otherwise.

For Australian businesses, the recurring issue is the importance of understanding where customer information is stored and which suppliers can access it.

What should Qantas passengers do now?

Passengers do not need to assume that their information has been compromised simply because they have booked a Qantas flight.

However, sensible precautions include:

1. Check bookings through official channels. Use the airline's official website or app rather than following unexpected email or SMS links.
2. Be cautious about urgent payment requests. Verify any claim that a booking requires an additional payment or immediate confirmation.
3. Protect frequent flyer accounts. Use a unique password and enable additional authentication protections where available.
4. Watch for convincing impersonation attempts. Fraudulent communications may contain accurate travel details.
5. Follow official airline notifications. Qantas and other affected airlines may provide additional information as investigations progress.

Passengers whose passport or identity-document details are confirmed as exposed should follow advice from the relevant airline and official identity-protection authorities.

There is no general reason for every Qantas passenger to replace a passport based solely on the current disclosures.

What Australian businesses can learn from the Amadeus breach

Businesses should not assume that outsourcing a technology service also transfers all responsibility for understanding its security risks.

A practical starting point is to document the suppliers, information and permissions the business depends on.

Practical questions worth asking include:

Where is customer information stored?

A business should understand which external platforms process personal information and whether copies are retained in additional systems.

Who can access that information?

Supplier employees, automated integrations and privileged service accounts may all require access. Permissions should be appropriate to their purpose.

How quickly would the supplier detect suspicious activity?

Security assurances are more meaningful when supported by evidence of monitoring, incident response and access review processes.

How would the business be notified?

Contracts and incident-response arrangements should establish how suppliers communicate suspected breaches, including what information they can provide and when.

What happens if a supplier is compromised?

Businesses should know how they would investigate customer exposure, preserve evidence, meet applicable notification obligations and communicate accurately with affected individuals.

For smaller Australian organisations, these considerations are particularly relevant when choosing website hosting, customer management platforms, online booking systems and managed IT providers.

A supplier's reputation or market size should not be treated as a substitute for understanding its security practices. The customer-data supplier responsibility article explores the questions to ask when a third-party platform holds personal information.

The unanswered questions

As the investigation continues, several questions remain unresolved:

• How were the affected system-account credentials obtained?
• What relationship, if any, existed between those credentials and the vulnerability acknowledged by Amadeus?
• Did unauthorised access occur continuously or intermittently during the reported period?
• What information could the affected account retrieve?
• Were records belonging to different airlines adequately separated?
• When was the suspicious activity first detected?
• How many Qantas passengers, if any, were affected?
• Will additional airlines disclose exposure?

Answers to these questions will be important in understanding the technical causes and wider implications.

Final assessment: a reminder that cybersecurity extends beyond your own network

The Amadeus incident demonstrates how interconnected modern information systems have become.

Qantas says its own infrastructure remains secure. Yet the airline is still investigating whether information associated with its customers was exposed through a technology supplier.

Other airlines have already confirmed access to substantial volumes of reservation information, including more sensitive personal details in some cases.

For organisations of every size, the lesson is clear.

Protecting customer information requires understanding not only your own security controls, but also the external systems, identities and suppliers trusted to handle that information.

At Solway Web Consulting, we help Australian businesses review website security, hosting arrangements and technical dependencies, including the risks introduced by third-party services.

Understanding those dependencies is an important part of building a more resilient online business. Contact Solway Web Consulting to discuss a review of your website, hosting and third-party dependencies.

Frequently asked questions

Has Qantas been hacked?

For this Amadeus incident, Qantas says its own systems and databases were not impacted. It is investigating whether booking information held by its supplier was affected. As at 4 November 2026, Qantas customer exposure remains unconfirmed. This is separate from its 2025 contact-centre incident.

Do passengers need to change passwords?

The disclosures reviewed do not establish that Qantas account passwords were exposed in this incident. JAL and ANA specifically say passwords were not involved. A Qantas booking alone is therefore not evidence that your password needs changing because of this breach. Use a unique password, follow any direct airline advice, and change it through the official website or app if you suspect your account has been compromised. Never enter it through an unexpected email or SMS link.

How do I know if my booking was affected?

Follow official airline updates and any individual notification. Use the airline's official website or app to check your booking or contact it through independently verified details. The disclosures reviewed do not establish a list of affected Qantas bookings, so an existing reservation alone does not show that your information was accessed.

Were passport numbers stolen?

JAL reports traces of access to additional personal information, including passport numbers, for around 2,000 customers. ANA identifies passport numbers among the additional details potentially compromised for around 1,700 customers. Those findings do not establish that every listed field was accessed for each person, or that Qantas passport information was exposed.

Related reading

For the website architecture side of this question, see why reducing unnecessary publicly exposed components matters. Removing an unnecessary CMS can reduce runtime exposure, but connected booking and customer-data services still need their own security review. This does not imply that PHP or WordPress caused the Amadeus incident.

Sources and further reading

• Amadeus — October 2026 security statement
• Cathay Pacific — Personal data security incident, 30 October 2026
• Japan Airlines — Unauthorised access to Amadeus passenger service system
• ANA — Notice regarding unauthorised access to passenger service system
• Australian Aviation — Qantas customer data possibly exposed in Amadeus hack
• Malaysia Airlines — Third-party technology provider incident, 31 October 2026
• Qantas — Information about its separate 2025 cyber incident

Editorial note: This article reflects information publicly available on 4 November 2026. The investigation remains ongoing. Confirmed findings, reported allegations and technical analysis have been distinguished where possible. The article will be updated as additional verified information becomes available.