Amadeus data breach affects multiple airline partners
Airlines including Japan Airlines, ANA and Cathay Pacific have disclosed unauthorized access to passenger reservation data following a security breach at Amadeus., CredSpark is a powerful, interactive content platform that helps organizatio
Source
What It Says
Travel technology giant Amadeus has experienced a data breach that allowed unauthorized access to passenger information across several of its airline partners. According to disclosures from carriers including Cathay Pacific and Japan Airlines, an unauthorized entity used compromised credentials assigned to an Amadeus system account to access reservation data.
The security incident occurred over an extended period between August 2023 and September 2026. The exposed information varied by passenger but included highly sensitive details such as passport numbers and contact information. Amadeus has since notified its affected airline partners of the breach.
Why It Matters
For the broader travel and hospitality ecosystem, including short-term rental (STR) operators and technology vendors, this breach highlights the persistent vulnerability of centralized, third-party distribution and reservation databases. Because travelers frequently book flights and accommodations in tandem, compromised personal data (like contact details and passport numbers) from airline databases can easily be leveraged by bad actors to target those same travelers with highly convincing phishing, social engineering, or payment fraud schemes during their stays.
Useful Signals
- Targeted Systems: Amadeus reservation systems.
- Compromised Credentials: The breach was executed using legitimate credentials assigned to an Amadeus system account, highlighting the risk of credential theft over direct software exploits.
- Exposed Data Fields: Contact details and passport numbers.
- Incident Duration: The unauthorized access persisted undetected for over three years (August 2023 to September 2026).
STR Tech Report Take
This incident is a stark reminder of the systemic risks inherent in travel tech integrations. STR property management systems (PMS), channel managers, and guest verification platforms often connect to the same global distribution networks or share similar API-driven architectures.
"An unauthorized party accessed reservation data in Amadeus systems using credentials assigned to an Amadeus system account," which underscores that the weakest link in travel cybersecurity is often credential management rather than system code. STR vendors must enforce strict multi-factor authentication (MFA), implement zero-trust access controls, and conduct regular audits of API credentials to prevent similar long-term, undetected access to guest profiles.
Original Source
PhocusWire: Amadeus data breach affects multiple airline partners
Get more insights like this
Weekly STR tech updates. No spam.