Spread the love

Qantas investigates potential passenger-data exposure as Asian airlines disclose affected bookings, hotels confirm separate Amadeus platform incidents and travel agencies demand answers.

The travel industry can arrange a flight, hotel and hire car before the coffee goes cold. Explaining exactly where the customer’s personal details travel afterwards is proving a much harder booking.

A cybersecurity incident involving Spanish technology giant Amadeus IT Group has placed Qantas and major Asian airlines under scrutiny. Japan Airlines, All Nippon Airways (ANA) and Cathay Pacific have disclosed exposure of reservation information, while Korean Air, Asiana Airlines and Malaysia Airlines have also reported concerns linked to the provider.

And the story does not stop at the departure gate. Hotels have separately disclosed unauthorised access involving Amadeus-operated reservation technology. Travel agencies, meanwhile, face a pressing question: could bookings made on behalf of their clients have been exposed without their own systems being breached?

The distinction between confirmed incidents and unanswered questions matters. An industry-wide hack of every Amadeus service has not been established.

Qantas seeks answers

Qantas says Amadeus notified it of unauthorised access to one of the supplier’s systems. The airline is assessing whether any Qantas bookings were affected, but stresses that its own systems and databases remain secure. It has notified the Australian Cyber Security Centre and Office of National Cyber Security.

For passengers, that distinction matters, although a supplier’s problem can still involve information entrusted to an airline. Qantas has not published a confirmed number of affected bookings.

The Asian disclosures are more precise. Japan Airlines and Japan Transocean Air identify approximately 92,000 affected customers. For roughly 90,000, the exposed information included names, booking references, dates, routes and travel class. For another 2,000, additional items included contact details, passport numbers and frequent flyer information.

ANA reports approximately 37,800 affected customers, around 1,700 of whom may have had additional personal details accessed. Cathay Pacific identifies approximately 53,000 affected bookings, chiefly involving passenger names, references and flight details, with more information potentially exposed in a smaller group.

The figures cannot responsibly be combined into one passenger total: two airlines count customers; Cathay counts bookings. Korean Air and Asiana have separately acknowledged reservation-related exposure, while Malaysia Airlines says customer information may have been affected and its investigation continues.

The airlines report no evidence that payment-card information or passwords were accessed through the disclosed airline incidents. Japan Airlines and Cathay also say their flight operations were unaffected.

What happened, and when?

Amadeus acknowledges a vulnerability in a travel booking display environment, saying certain booking-display data was accessible. It says it fixed the weakness, strengthened monitoring and has no evidence of financial-data access or ransomware exploitation.

Airline notices identify a period from August 2023 to September 2026 in which external access was detected or relevant reservations were processed. That is not proof of uninterrupted attacker access for more than three years. The exact timing and full scope remain under investigation.

Cathay says the unauthorised party used credentials assigned to an Amadeus system account. The airline says it has since reset those credentials. The airline has not fully explained how the publicly described access methods and vulnerabilities relate.

Travel agencies have good reason to ask questions

For Australian travel advisors, Amadeus is not an unfamiliar name hidden in the small print. Alongside Sabre and Travelport, it supplies the distribution technology many agencies rely on to search fares, build itineraries, create passenger name records, issue tickets, and service bookings.

A passenger name record, or PNR, may contain enough information to make a fraudulent airline message sound convincing. An agency might never suffer an intrusion of its own, yet information relating to an agency-managed reservation could still be exposed at another provider.

German technology reporting adds another dimension. An October investigation by heise online, described in subsequent specialist reporting, identified hundreds of German travel agency office identifiers associated with an earlier-reported Amadeus booking-display vulnerability. An office identifier is not itself proof that an agency login was stolen or its booking system accessed. Amadeus has also not publicly established that the technical finding and recent airline disclosures concern the same intrusion.

For agencies, the questions are practical: were agency-created PNRs involved, were any user credentials exposed, and what notification or audit information will travel sellers receive? Without answers, sweeping claims that Australian travel agencies have been hacked would be irresponsible.

Hotels: confirmed exposure, but connections remain unclear

The hospitality angle is no longer merely hypothetical. On 25 September, LEGOLAND Japan Hotel said an Amadeus-operated online booking platform had suffered unauthorised access to guest names, email addresses and telephone numbers. The hotel identified 1,557 potentially affected reservations; it said payment, password, financial and passport information was not accessed.

In Germany, hotel group Maritim confirmed a separate incident involving Amadeus’s iHotelier reservation solution. Hospitality trade publication Tageskarte reported that Maritim notified guests after reservation lists were taken; it sent 8,716 notification emails. Amadeus told the publication it had detected unusual activity connected to an iHotelier interface on 11 September.

These are genuine hotel-related disclosures involving Amadeus services. They must not, however, be presented as proven consequences of the same attack affecting Asian airlines. Public information has not established whether the incidents are technically connected.

Australia’s Crown Hotels also disclosed a September incident involving an unnamed third-party hotel reservation provider. Crown did not identify that provider, so linking its incident to Amadeus would be speculative.

Car hire: exposure still unproven

Amadeus distributes travel products across airlines, hotels and mobility providers, including car rental content. But commercial connectivity does not establish a breach. The disclosures reviewed identify no verified car rental operator-specific compromise attributable to these Amadeus incidents.

That leaves a legitimate question for car hire businesses about supplier access, retained reservation information and third-party notification procedures, not a basis for announcing that their customer records have been stolen.

Fraud risk, not a global shutdown

Names, flight dates and booking references could help an impostor write a persuasive message demanding payment or claiming that a reservation is about to be cancelled. That risk is real; confirmed criminal misuse of the airline data is another matter. Japan Airlines and Cathay say they have not identified evidence of misuse.

For agencies, prudent steps include reviewing Amadeus account permissions, enabling multifactor authentication where supported, removing departed employees’ access and independently verifying unexpected ticket changes, refund instructions or payment requests. Hotels and car rental operators should seek clear incident information from their own providers.

Australian businesses covered by the Privacy Act must also consider the Notifiable Data Breaches scheme. Notification is required for an eligible breach likely to cause serious harm, not automatically for every supplier incident.

Travellers should follow verified airline or hotel notices, avoid unsolicited booking links and use official contact channels. Where an advisor manages the itinerary, consult that travel advisor first.

So far, the disclosures do not establish a global reservations shutdown or widespread interruption to flights, hotels or car rentals. The greater immediate issue is confidence in information security.

For an industry that promises seamless journeys, the unanswered question is who takes responsibility when information slips between the seams. A lost suitcase can sometimes catch the next flight. Lost control of personal data is seldom so obliging.