Malaysia Airlines joins the airlines with customer data exposed by the Amadeus breach

Malaysia Airlines reported this Sunday that some of its customers' information may have been affected by a cybersecurity incident at Amadeus, its booking technology provider, according to Reuters. The airline says its own systems were not breached, that there is no evidence of access to financial data and that it is investigating the scope with Amadeus. It asked its customers to be wary of unsolicited messages asking for personal or financial data.

It joins other airlines that have already reported data exposed by the same incident. Cathay Pacific put the number of affected bookings at about 53,000, with booking number, passenger name and flight details in most cases, according to Reuters and Europa Press. Japan Airlines speaks of about 92,000 customers, about 2,000 of them also with their email, phone or passport number exposed, according to BleepingComputer. ANA puts the number of affected passengers at up to 37,800, according to Europa Press; Asiana, Korean Air and the German carrier Condor have also said they are affected.

According to the airlines, the access affects bookings made between August 2023 and September 2026. Amadeus says it detected a vulnerability in an environment used to look up travel bookings, that it has fixed it, that there is no evidence of access to payment data or that it was used for a ransomware attack, and that it is in contact with its customers and with the authorities, according to Europa Press and Reuters.

Amadeus, headquartered in Madrid, serves more than 400 airlines, according to BleepingComputer. The company has not said how many airlines or how many passengers are affected in total.