iscover
Qantas says it has been potentially impacted by a data breach affecting global travel technology provider Amadeus.
Amadeus, which services around 141 global airlines including Korean Air, Asiana, Japan Airlines, ANA, and Cathay Pacific, has reportedly advised its clients that no payment or financial data was accessed, though other personal details may have been exposed.
This content is available exclusively to Australian Aviation members.
A monthly membership is only $5.99 or save with our annual plans.
- Australian Aviation quarterly print & digital magazines
- Access to In Focus reports every month on our website
- Unlimited access to all Australian Aviation digital content
- Access to the Australian Aviation app
- Australian Aviation quarterly print & digital magazines
- Access to In Focus reports every month on our website
- Access to our Behind the Lens photo galleries and other exclusive content
- Daily news updates via our email bulletin
- Unlimited access to all Australian Aviation digital content
- Access to the Australian Aviation app
- Australian Aviation quarterly print & digital magazines
- Access to In Focus reports every month on our website
- Access to our Behind the Lens photo galleries and other exclusive content
- Daily news updates via our email bulletin
The Flying Kangaroo has notified the Australian Cyber Security Centre and the Office of National Cybersecurity of the breach.
“We have been advised by global travel technology provider Amadeus that there has been unauthorised access to one of their systems,” a Qantas spokesperson said.
“Amadeus advised the issue was contained in September and we’re working with them to understand the impact to any Qantas bookings. There is no impact to Qantas systems or databases which remain secure.”
Cathay Pacific is among the airlines that have confirmed they were impacted, with the Hong Kong carrier saying “around 53,000 bookings relating to Cathay Pacific were affected by the unauthorised access in Amadeus’s system, which occurred between August 2023 and September 2026”.
“In the majority of cases, the information accessed included booking reference, passenger name, and flight details,” the airline said.
“In a smaller subset of cases, additional personal information including but not limited to email and phone contacts, travel document and/or frequent flyer number were potentially accessed. However, there is no evidence that financial or payment information was accessed.
“Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus has not identified evidence that the affected data has been misused.”
Both Malaysia Airlines and Japan Air Lines have also issued statements detailing their exposure to the breach, with JAL saying around 92,000 passengers were affected and Malaysia Airlines saying it is also working with Amadeus to assess the impact.
The reports are unrelated to a data breach Qantas itself suffered last year, which saw customer data including names, email addresses, phone numbers, birth dates, and frequent flyer numbers stolen in a cyber attack against one of its call centres.
The Office of the Australian Information Commissioner (OAIC) determined in July that there was nothing to suggest Qantas had not done its part to protect its customers, saying it had not failed to take reasonable steps to protect its customers’ data, and that its response afterwards had reduced the impact.
Want to see more stories from trusted news sources?
Make Australian Aviation a preferred news source on Google.
Click here to add Australian Aviation as a preferred news source.
