Amadeus breach reaches Malaysia Airlines as carrier count climbs past four

Malaysia Airlines has told customers that information processed between August 2023 and September this year may have been exposed in a cybersecurity incident at Amadeus, the reservation-technology provider behind its booking systems. The flag carrier said its own IT systems were not breached and that it had found no evidence financial information was accessed.

The airline said it is working with Amadeus and other parties to investigate the incident and assess its impact, and urged customers to stay alert to suspicious or unsolicited messages, especially any asking for personal or financial details. Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, but did not answer a question on how many customers' data were affected, according to Token Times.

Malaysia Airlines joins a growing list of carriers reporting exposure through the same provider. Cathay Pacific said the breach affected data involving 53,000 bookings, while Japan Airlines put the figure at 92,000 customers. South Korea's Asiana Airlines is among the others that have reported customer data compromised in recent days.

The episode puts a shared piece of airline infrastructure under scrutiny: a single reservation-technology supplier sits behind the booking data of carriers across several markets. For travellers, the immediate risk is targeted phishing that trades on real booking details; for airlines, it is the compliance and notification burden that follows when a vendor's environment is compromised.