SockAnalyst
← All playbooks
HighBreach · 2026-10-28

Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others

SockAnalyst · Security+ certified analyst.

What happened

Someone used valid system-account credentials to access the Amadeus passenger service system from Aug 10, 2023 to Sep 23, 2026. Korean Air and Asiana are also affected. No card data or passwords.

Update (2026-10-30): Cathay Pacific says about 53,000 bookings were affected and that the attacker used login credentials assigned to an Amadeus system account. Amadeus reset the password and added monitoring.

Update (2026-10-31): Malaysia Airlines says customer data processed through Amadeus between Aug 2023 and Sep 2026 may be affected; Korean Air and Asiana also confirmed exposure.

Update (2026-11-04): Singapore Airlines says about 46,000 booking records were accessed (about 620 also exposed emails, phones, travel document details and KrisFlyer numbers); its own systems weren't breached. Amadeus says a vulnerability in its booking-display environment made certain booking data accessible, it has fixed it, and there's no evidence payment data was accessed.

Update (2026-11-11): Finnair says Amadeus told it about 116,000 Finnair bookings were included in the flight lists taken in the breach; about 750 reservations (30 of them Aurinkomatkat travel packages) were opened for examination. Finnair says its own systems were not compromised and Amadeus confirmed no card numbers or passwords were accessed. Finnair issued new booking numbers for affected active reservations and is emailing customers whose contact details it received.

Who's affected

Customers of Singapore Airlines (about 46,000 booking records), Cathay Pacific (53,000), Japan Airlines (92,000), All Nippon Airways (37,800), plus Malaysia Airlines, Korean Air and Asiana. Exposed data includes names, booking references, itineraries and booking classes; for about 620 SIA records, emails, phone numbers, travel document details and KrisFlyer numbers too. Some airlines say data processed between August 2023 and September 2026 may be affected. Amadeus says no bank or card data was exposed and no bookings were changed.

✅ Fix / patch

  • If you flew one of these airlines since 2023, expect a notice. If the airline asks you to change your booking reference, do it through the airline's official site or app.
  • Treat emails, texts or calls quoting your itinerary or booking reference as suspect, since that detail makes phishing look real. Don't click links; go to the airline directly.
  • Change your frequent flyer account password and turn on any extra login protection the airline offers.
  • Review third-party vendor logins: valid creds went unnoticed for 3 years.

🔎 Quick hunt check

For travel and corporate travel teams: watch for phishing that cites real booking references or itineraries, and flag frequent flyer account logins, password resets or mileage transfers from new devices or locations.

MITRE ATT&CK: T1078, T1199, T1213, T1566

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=email (subject="*booking*" OR subject="*reservation*" OR subject="*itinerary*" OR subject="*rebook*" OR subject="*KrisFlyer*" OR subject="*Asia Miles*" OR subject="*Mileage*")
NOT src_user IN ("*@jal.com","*@jal.co.jp","*@ana.co.jp","*@cathaypacific.com","*@singaporeair.com.sg","*@malaysiaairlines.com","*@koreanair.com","*@flyasiana.com")
| stats count values(subject) as subjects by src_user, recipient
let airlines = dynamic(["jal.com","jal.co.jp","ana.co.jp","cathaypacific.com","singaporeair.com.sg","singaporeair.com","malaysiaairlines.com","koreanair.com","flyasiana.com"]);
EmailEvents
| where Subject has_any ("booking","reservation","itinerary","rebook","KrisFlyer","Asia Miles","Mileage")
| where not(SenderFromDomain has_any (airlines))
| summarize count(), make_set(Subject,10) by SenderFromAddress, RecipientEmailAddress, DeliveryAction

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →