Malaysia Airlines has confirmed that some customer information may have been exposed in a security incident at Amadeus IT Group, the Spain-based company that runs its reservation system. In a statement on its website, the national carrier said the exposure may cover customer information processed through Amadeus between August 2023 and September 2026, about three years of bookings. The airline says its own IT systems were not compromised and that there is currently no evidence financial information was accessed. It has not said how many customers are affected or what kinds of personal data were involved. Malaysia Airlines is the latest carrier to disclose exposure through Amadeus, after Cathay Pacific, Japan Airlines, Korean Air and Asiana.
What Happened
Malaysia Airlines Bhd published its statement on Saturday 31 October, according to the New Straits Times and The Star. Reuters, as carried by CNA and The Straits Times, reported it on Sunday 1 November. Coverage by Malay Mail and Malaysia's state broadcaster RTM matches the airline's wording.
The airline said it is "treating this matter with the utmost seriousness" and is working with Amadeus and "relevant parties" to investigate and assess the impact. It has not said when or how it found out about the incident. It promised further updates as more information comes in.
Malay Mail reports that Amadeus began notifying affected carriers in late October 2026. That fits the timing of the other disclosures. Cathay Pacific said on 30 October that about 53,000 of its bookings were affected, according to the New Straits Times. Reuters reports that Japan Airlines put its figure at 92,000 customers. According to Korean Air's statement, as compiled by the security blog Safeguard, Amadeus formally notified Korean Air on 20 October 2026 that there were signs personal information had leaked from its system.
Amadeus told Reuters it had become aware of a vulnerability affecting a "travel booking display environment". It did not answer questions about how much data was affected. Amadeus has not published a statement specific to Malaysia Airlines, and no regulator filing has been made public.
What Was Taken
Malaysia Airlines has not disclosed the number of affected customers or the data types. Both Malay Mail and the New Straits Times point out that the statement leaves these out. The only firm claim is a negative one: no evidence so far that financial information was accessed.
The other carriers' disclosures show what Amadeus booking records usually hold:
- Cathay Pacific said most of its affected records contained booking references, passenger names and flight details. A smaller number may also have included email addresses, phone numbers, travel document information and frequent flyer numbers. It also reported no evidence of payment data access.
- heise online, which examined a separate exposed Amadeus environment in October, says the records it could see held full names, dates of birth, booking codes (PNRs), contact details, and ID and passport data in plain text. Most of what it checked related to Lufthansa and Condor flights.
Whether Malaysia Airlines records held the same fields has not been confirmed. Organisations should still plan as if names, PNRs, contact details and possibly travel document data are in someone else's hands.
Why It Matters
This is a supply chain breach. The airline's own network was not touched, but its customer data was still exposed. Most of the world's airlines rely on a small number of reservation and distribution providers, so one weakness at Amadeus reaches many carriers at once. The victim count has grown over roughly two weeks, and more carriers are likely to come forward as Amadeus works through its notifications.
The time window is worth noting. Malaysia Airlines' exposure period, August 2023 to September 2026, is the same window Korean Air and Asiana gave for their incident, according to Safeguard's summary of their statements. That suggests Malaysia Airlines may be caught up in the same event. Nobody has confirmed this.
PNR data is very useful for fraud. A booking reference plus a surname is often enough to open, change or cancel a booking through an airline's "manage booking" page. Real itinerary details also make phishing far more convincing: fake rebooking notices, refund offers and "verify your passport" messages that quote real flights. Malaysia Airlines' advice to watch for unsolicited messages asking for personal or financial details points directly at this risk.
The Attack Technique
Amadeus has not explained how it was breached, and accounts differ. Public reporting describes two separate Amadeus exposures in October 2026. No source has confirmed which one, if either, affected Malaysia Airlines:
- Misuse of a system account. According to Korean Air and Asiana statements compiled by Safeguard, booking data leaked when someone without authorisation used an Amadeus system account between August 2023 and September 2026. Safeguard says it found no Amadeus statement on this event as of 26 October. Everything known about it comes from the airlines.
- Exposed heap dump. heise online reported on 13 October that a Spring Boot application in an Amadeus booking environment had a management endpoint open without authentication, which served a heap dump (an image of the application's memory). heise says the dump contained credentials and authentication tokens, including administrator passwords that gave read and write access to the global system. It also says passenger records could be searched by surname, and that hundreds of German travel agency office IDs were visible. Amadeus confirmed this "display environment" exposure to heise, and the hole appears to have been closed.
Amadeus's comment to Reuters about a "travel booking display environment" sounds like the second event. The three-year window shared by Malaysia Airlines and the Korean carriers sounds like the first. Safeguard stresses that nobody has said the two events share a cause. No CVE or indicators of compromise have been published for either.
What Organizations Should Do
- Assume your PNR data is exposed if you use Amadeus. Airlines, travel agencies and corporate travel teams should ask Amadeus directly whether their office IDs, records or service accounts fall within either exposure. Do not wait to be notified.
- Rotate and limit long-lived service accounts. Review every system account that touches booking or reservation platforms. Rotate the credentials, cut permissions down to what each account actually needs, add IP allowlisting, and alert on unusual query volumes or bulk surname lookups.
- Lock down Java management endpoints. Check Spring Boot Actuator and similar interfaces, especially /heapdump, /env and /threaddump. Turn them off in production or put them behind authentication on internal networks only. Treat any heap dump that has ever been exposed as a full credential compromise.
- Harden booking self-service. Add rate limits and extra verification, such as a one-time code to the email on file, before anyone can change, cancel or refund a booking using only a PNR and surname.
- Warn customers before the phishing starts. Tell customers plainly which channels you use to contact them and that you will never ask for passport or card details by email or SMS. Brief call centres to expect social engineering that quotes real itineraries.
- Review your third-party contracts. Make sure contracts with reservation providers set notification deadlines, give you audit rights and require evidence of how secrets are managed. In this case, airlines learned of a possible three-year exposure only after it had ended.
Sources: Malaysia Airlines says customers may be affected by Amadeus breach... | Security vulnerability in flight booking system heise online | Malaysia Airlines affected by Amadeus breach The Straits Times | Malaysia Airlines warns customers of data exposure in Amadeus cyber... | Malaysia Airlines says IT systems unaffected by Amadeus data breach | Amadeus Data Exposures: Korean Air, Asiana, Lufthansa and Condor S... | Insiden siber Amadeus tidak jejas sistem IT MAB - Portal Berita RTM | 'Our system not compromised despite vendor's ...