Amadeus Data Breach: What It Means for Your Business

The Amadeus data breach is now one of the biggest travel-industry security stories of the fall: someone used a login tied to an Amadeus system account to read airline booking data for roughly three years, from August 2023 to September 2026, and about a dozen airlines have now told customers their passengers were caught up in it. Japan Airlines, Cathay Pacific, Singapore Airlines, ANA, Korean Air, Asiana, Malaysia Airlines, Finnair, Thai Airways, Norwegian and Condor are among the carriers that have come forward, and the list was still growing as of November 9.

The short answer: if you or your employees flew one of the affected airlines in that window, assume your name, booking code, flight dates and route may be in criminal hands. Card numbers and passwords were not taken, according to Amadeus and the airlines. The real risk for a small business is very convincing travel scams: fake “your booking changed” emails, fake refund offers and fake airline phone calls that already know exactly where your people are flying. Tell your team today to never act on a booking message through a link, and open the airline’s app or type its website instead.

What Happened

Amadeus is a Spanish technology company most travelers have never heard of. Its systems run reservations, ticketing and check-in for hundreds of airlines, which means your booking may have passed through Amadeus even if you bought the ticket directly from the airline.

Here is what the public record shows so far:

• An Amadeus spokesperson told The Record from Recorded Future News that the company found a vulnerability in a “travel booking display environment” and that “certain booking-display data was accessible.” Amadeus said there is no evidence payment or financial data was accessed and no sign of ransomware.
• Airlines told by Amadeus say the attacker used login credentials assigned to an Amadeus system account, not a break-in at the airlines themselves. Korean Air, Asiana and Cathay Pacific described it that way, per The Record and The Contrail’s running tracker.
• The access window ran from about August 2023 to late September 2026. Japan Airlines said Amadeus first told it on October 23, 2026. That is more than three years of quiet access before anyone noticed.
• Reported numbers so far: Japan Airlines about 92,000 customers, Cathay Pacific about 53,000 bookings, Singapore Airlines about 46,000 booking records, ANA about 37,800 passenger records (The Record, The Contrail).
• On November 9, Finnair said about 116,000 of its reservations were on flight lists tied to the incident, and Thai Airways said about 60,529 passenger records may have been accessed. Cybernews and Dutch reporting add Norwegian and Condor to the list.
• Qantas was still checking whether its bookings were affected, per The Contrail.

Amadeus has not said how many airline customers were hit in total, so expect more notices over the next few weeks.

What Was Exposed (and What Was Not)

For most affected passengers:

• Passenger name
• Booking reference (the six-character code, also called a PNR)
• Flight date, route and cabin class

For a smaller group (for example about 2,000 JAL customers and about 620 Singapore Airlines records):

• Email address and phone number
• Passport number and nationality
• Frequent flyer number
• Ticket number and seat details

Not exposed, according to Amadeus and the airlines: credit card numbers, payment details and account passwords. Finnair said Amadeus confirmed no payment details or passwords were accessed.

That “not exposed” list is good news, but don’t stop reading there. A name plus a booking code plus a real itinerary is exactly what a scammer needs to write a message your employee will believe.

Why This Matters for a Portland Small Business

I’ve been in IT since 1996, and the pattern after a travel breach is always the same. Nobody steals money from the booking data directly. They use it to make the next message believable.

Picture a sales rep from your Tualatin or Vancouver office who has a trip to Tokyo or Singapore next month. She gets an email that says, “Your flight on December 4 from Seattle to Narita has a schedule change. Please confirm your seat and pay the fare difference.” It has her name, the right date, the right route, and her real booking code. That email doesn’t look like phishing. It looks like customer service.

Here is where small businesses get hurt:

• Card theft on fake “change fee” or “refund” pages. The company card goes in, and the charges start.
• Microsoft 365 credential theft. “Sign in to view your updated itinerary” pages are a favorite way to harvest work passwords, and stolen work logins lead straight to business email compromise.
• Frequent flyer account takeover. Miles get drained, or the account becomes a source of more personal data.
• Phone scams. A caller “from the airline” reads back the booking code and asks for the card number to “keep the reservation.”
• Fake invoice and travel-agent fraud. Your bookkeeper gets a convincing bill for “the Asia trip” that never came from your agency.

There is also a bigger lesson for owners. Amadeus didn’t get hacked through a flashy zero-day at the airline. Someone used a working account login, and nobody spotted it for three years. Your business has the same kind of accounts: shared vendor logins, an old service account for the copier or the accounting sync, a former employee’s account nobody turned off. That is third-party and credential risk, and it is fixable.

Step-by-Step Checklist: What to Do This Week

Work through these in order. Most take minutes, not hours.

1. Find out who flew an affected airline

Ask staff (and yourself) whether anyone booked Japan Airlines, Cathay Pacific, Singapore Airlines, ANA, Korean Air, Asiana, Malaysia Airlines, Finnair, Thai Airways, Norwegian, Condor or StarFlyer since August 2023. Check your travel agency or corporate card statements if you aren’t sure. Include codeshare flights booked through a U.S. airline but operated by one of these carriers.

2. Warn your team about booking scams today

Send a short note: “Airline booking data was exposed in a vendor breach. Expect fake emails, texts and calls that know your real flight details. Never click a link or call a number in an unexpected booking message. Open the airline app or type the website yourself.” That one paragraph stops most of the damage.

3. Change booking codes on upcoming trips if the airline offers it

Singapore Airlines and Finnair said they are contacting travelers with upcoming trips and issuing new booking references. If you get one of these notices, verify it by opening the airline app or website yourself, then confirm the trip details there.

4. Lock down frequent flyer accounts

Give every loyalty account a unique password stored in a password manager, and turn on two-step verification or login alerts where the airline offers them. Review recent activity and the email and phone on file. Some frequent flyer numbers were exposed, so treat these accounts like any other account with stored value.

5. Treat exposed passport numbers seriously, but calmly

If an airline tells you a passport number was involved, keep the notice. A passport number alone usually isn’t enough to steal an identity, but combined with other data it helps. If you’re worried, contact the U.S. State Department passport office for guidance, and watch your credit.

6. Put company cards on alert

Turn on real-time transaction alerts for corporate and travel cards. Tell your bookkeeper that no “fare difference,” “change fee” or “refund processing” payment gets made from an email or phone call without checking the booking directly with the airline or your agency.

7. Verify anything that asks for a sign-in

Any travel email that asks someone to sign in with their work account is a red flag. Airlines don’t need your Microsoft 365 password. Make sure MFA is on for every mailbox, and that your email filtering is catching lookalike domains.

8. Check your own shared and service accounts

Use this breach as the excuse to list every shared vendor login and service account in your business. Turn off anything unused, rotate passwords on the rest, and add MFA wherever the vendor supports it. Ask your key vendors how they protect the accounts that touch your data.

9. Watch for your domain on the dark web

Booking data tends to get resold and combined with other breach dumps. Dark web monitoring tells you when your company’s email addresses show up in a new leak, so you can reset passwords and warn staff before a scammer uses it.

What a Fake Amadeus-Breach Message Looks Like

Scammers love breach headlines because people are already expecting an email. Watch for:

• “Important: your booking was affected by the Amadeus incident. Click to secure your reservation.”
• “Your flight has a schedule change. Confirm within 24 hours or your seat will be released.”
• “You are eligible for compensation for the data breach. Enter your card to receive your refund.”
• A text with a short link and your real booking code.
• A phone call from “airline security” that asks you to read back a verification code.

Real notices exist. Finnair, for example, said it will email affected customers and pointed people to Amadeus at dataprotection@amadeus.com. The safe habit is the same either way: read the notice, then go to the airline yourself instead of using anything in the message.

Your One-Page Checklist

The Vendor Lesson Owners Shouldn’t Skip

Every one of these airlines said the same thing: “our systems were not breached.” That’s true, and it didn’t help their customers at all. When a vendor holds your data, the vendor’s security is your security. We covered the same third-party pattern in the DreamHost data breach, where a hosting vendor’s File Manager exposure put customer websites and webmail at risk.

You don’t need an enterprise vendor risk program. You need a short list of the vendors that hold your customer or employee data (payroll, accounting, CRM, booking, file sharing), a contact for each one, and answers to three questions: Do you require MFA on accounts that can reach our data? How fast will you tell us about a breach? Can we turn off accounts when someone leaves? If a vendor can’t answer those, that’s worth knowing before the next headline.

The other lesson is detection. Three years of quiet access is a monitoring failure, not just a password failure. For a small business, the practical version is alerts on unusual sign-ins in Microsoft 365, alerts when someone creates a forwarding rule, and someone actually reading those alerts. Our infostealer and session cookie guide covers why stolen logins often get past MFA, and how to catch them.

How PDX IT Helps

We’re based in Tualatin and support small businesses across Portland, the west side suburbs and Vancouver, WA. When a big vendor like Amadeus has a breach, the useful work is plain and practical: warn your people with the right message, tighten email filtering and MFA, clean up shared and service accounts, and watch for your company’s logins in new leak data.

Dark web monitoring is included in our Gold and Platinum plans, so new exposures of your company’s credentials get flagged instead of found after a fraud attempt. We pair that with INKY email security to help catch the phishing waves that follow breach news, plus Microsoft 365 hardening and managed endpoint protection. Platinum also includes SaaS Protect, which backs up your SharePoint and OneDrive data so a compromised account doesn’t mean lost files.

You can compare plans on our managed services page or read more about our proactive cybersecurity services. Every managed plan comes with a 90-day opt-out: if it isn’t working for you in the first 90 days, you can cancel with no penalties.

FAQ: Amadeus data breach

What is the Amadeus data breach?

It is a security incident at Amadeus IT Group, the Spanish company that runs reservation, ticketing and check-in systems for many airlines. Someone used login credentials tied to an Amadeus system account to access booking display data from about August 2023 to September 2026, and about a dozen airlines have since notified customers.

Which airlines are affected by the Amadeus data breach?

Airlines that have reported affected passengers include Japan Airlines, Cathay Pacific, Singapore Airlines, ANA, StarFlyer, Korean Air, Asiana, Malaysia Airlines, Finnair, Thai Airways, Norwegian and Condor. Qantas was still checking as of early November. Amadeus has not published a full list.

Were credit card numbers or passwords stolen?

According to Amadeus and the affected airlines, no. The exposed data was mainly names, booking codes, flight dates, routes and cabin class. For a smaller group it also included email addresses, phone numbers, passport numbers, nationality and frequent flyer numbers.

What should my employees do if they flew an affected airline?

Treat any unexpected email, text or call about their booking as suspicious, open the airline app or type the website instead of clicking links, accept new booking codes only after verifying them directly, put unique passwords and alerts on frequent flyer accounts, and watch company card activity.

Does the Amadeus data breach affect businesses that don’t travel internationally?

The direct exposure is limited to passengers of affected airlines, but the lesson applies to everyone. Attackers used a working account login and went unnoticed for three years. Review shared vendor logins and service accounts, require MFA, and set up alerts for unusual sign-ins.

How does dark web monitoring help after a vendor breach?

It watches breach dumps and criminal markets for your company’s email addresses and related logins and alerts you when they appear. That gives you time to reset passwords, warn staff and check mailboxes before someone uses the data against you. PDX IT includes it in the Gold and Platinum plans.

Want a Free Dark Web Scan for Your Domain?

If you’d like a plain-English look at whether your company’s email addresses are already showing up in breach data, we’re happy to run a free dark web scan and walk through the results with you. Contact us, call Steve at 971-331-4871, or email sales@pdxittech.com. Even if you never become a client, you’ll know where you stand.

This article is general information for small business owners, not legal or travel advice. For questions about a specific booking, use your airline’s official app, website or written notice.