Australian airline Qantas is investigating whether its passengers’ booking information was exposed following unauthorized access to a system operated by Amadeus, a major travel technology provider. The incident has already affected reservation data belonging to customers of several international airlines. However, Qantas has not confirmed whether any of its passenger records were accessed, and the airline says its own systems and databases remain secure.
On November 2, 2026, Qantas confirmed that Amadeus had notified it about unauthorized access to one of the technology company’s systems. Amadeus provides reservation, ticketing, and passenger service technology to airlines worldwide. Notices issued by other affected airlines identified traces of unauthorized access involving reservation records dating from August 10, 2023, to September 23, 2026. Qantas is still determining whether any of its bookings were included in the affected information.
Qantas confirmed that Amadeus had informed the airline about the incident and that the security issue was contained in September 2026. The Australian carrier is working with Amadeus to determine whether any Qantas booking information was affected. Importantly, Qantas said its own computer systems and databases remain secure, and there is currently no indication that attackers gained access to the airline’s internal systems.
The airline has also notified the Australian Cyber Security Centre and the Office of National Cyber Security. These notifications are part of its response as the investigation continues. However, Qantas has not confirmed how many passengers, if any, were affected. The exact type of Qantas customer information potentially exposed also remains unclear.
The Amadeus incident is separate from the cybersecurity breach Qantas experienced in 2025, when attackers accessed customer information through a third-party contact centre platform. The latest investigation concerns reservation data held in Amadeus’s technology environment. No connection between the two incidents has been established.
Several international airlines have confirmed that customer reservation information was affected by the Amadeus incident. According to Cathay Pacific’s official security notice, approximately 53,000 bookings were affected. Japan Airlines confirmed that around 92,000 customers were affected, while All Nippon Airways (ANA) reported approximately 37,800 affected customers. Malaysia Airlines has also acknowledged possible exposure of customer information but has not announced a confirmed number in its initial notice.
The type of information affected varies between customers and airlines. Japan Airlines reported that approximately 90,000 customers had basic reservation details accessed, including names, booking references, flight dates, routes, and travel classes. Around 2,000 additional customers had more detailed information involved, potentially including contact details, passport numbers, and frequent flyer information. ANA reported a similar distinction, with approximately 36,100 customers affected at the basic reservation-data level and another 1,700 involving additional personal details. These figures relate to those airlines and do not establish what, if anything, was exposed for Qantas passengers.
The affected airlines have reported some reassuring findings about sensitive financial information. Cathay Pacific said it had found no evidence that payment or financial details were accessed, while Japan Airlines and ANA stated that credit card numbers and account passwords were not involved in their reported cases. However, exposed booking references, travel details, and contact information could still create security risks. Criminals may use such details to make phishing emails, fake flight-change notifications, or fraudulent airline support messages appear more convincing.
The incident involved unauthorized access to passenger reservation information stored within Amadeus’s technology systems. Cathay Pacific reported that an unauthorized party used login credentials assigned to an Amadeus system account to access certain booking records. Amadeus has taken measures to contain the problem, including resetting credentials and improving security monitoring. According to information shared with affected airlines, Amadeus had not identified evidence that the accessed data was misused. However, the investigation remains ongoing, and the full technical cause has not been publicly established.
The incident highlights the growing cybersecurity risks associated with third-party technology providers. Airlines depend on outside companies for services such as reservations, ticketing, and passenger information management. Even when an airline’s own systems remain secure, problems involving external technology partners can put customer information at risk. TechBonafide has previously reported on cybersecurity threats targeting airlines and their technology partners, although those earlier incidents are not established as connected to the Amadeus case. Businesses can also reduce these risks by strengthening access controls and monitoring, as discussed in our guide to third-party security risks in connected applications.
Passengers who have booked flights with Qantas or other affected airlines should remain cautious about unexpected travel-related messages. Qantas provides information about fraudulent airline communications on its official cyber safety and scam awareness page. The Australian Government also offers practical guidance on identifying phishing scams. Travelers should avoid suspicious booking links, never share passwords or verification codes, and contact their airline through an official website or mobile application. Before entering personal information on an unfamiliar page, readers can also learn how to check whether a website is trustworthy. These precautions do not mean Qantas passenger data exposure has been confirmed.
For now, Qantas continues to assess whether its customers were affected by the Amadeus cyberattack. The airline has not announced a confirmed number of exposed passenger records, and there is no reported disruption to its flight operations from this incident. Further updates are expected as the investigation establishes the full impact of the unauthorized access. The case serves as another reminder that protecting passenger information requires strong cybersecurity across the entire travel technology industry.
