Several airlines have notified customers about unauthorized access to passenger reservation information associated with a shared Amadeus system. Japan Airlines, ANA and Malaysia Airlines published notices in late October. Their disclosures describe airline-specific scopes; they do not show that every carrier using Amadeus was affected.
What the notices say
Japan Airlines published a notice on October 28 and ANA issued a special notice to customers. Malaysia Airlines also posted passenger guidance. Each airline is the primary source for what it knows about its own passengers and records.
BleepingComputer and ITmedia reported the developments, while airline notices provide the direct account. Do not combine the airlines’ figures or data categories into one assumed total: the public notices are not equivalent and may describe different sets of records.
A third-party system creates shared exposure
Airlines rely on interconnected reservation and service providers to manage bookings and customer interactions. Access to a provider environment can therefore affect records handled for a customer, even when the airline’s own network is not described as compromised.
The public notices attribute the affected reservation environment to Amadeus. They do not establish that all Amadeus systems, all participating airlines, or all passenger records were accessed. The correct scope remains the one each airline communicates.
What passenger information means
JAL reports access traces involving about 92,000 records: about 90,000 included a name, booking reference, flight dates and routes, and cabin class; about 2,000 more also included items such as email address, phone number, passport number, nationality, and frequent-flyer number. ANA reports about 37,800 records, including about 1,700 with similar additional categories such as passport numbers. Both airlines say credit card numbers and passwords were not involved. Malaysia Airlines has not published a passenger count or specific data categories. These are separate airline scopes and should not be added into one verified total.
Even limited itinerary details can make targeted messages more convincing. A scammer might refer to a real flight or booking and ask for a fee, login, or verification code. An accurate booking reference does not prove that the sender is the airline.
Advice for travelers
Check your airline’s official app or website for a notice and use the contact route already published there. Do not follow unexpected links to “confirm” a reservation, provide a one-time code, or pay a new fee. If you receive a direct notice, follow its guidance for the particular data involved.
Airlines and providers should coordinate customer notifications, confirm the records in scope, and review access controls and monitoring across connected reservation services. Contractual responsibility does not replace clear communication to travelers.
What is still unclear
The public material does not provide one complete cross-airline account of the initial access, duration, or total records involved. It also does not justify saying that every Amadeus customer was affected. Updates from each airline are needed to refine those points.
The connection to Soclyde
Unique passwords help limit the impact if a password is exposed elsewhere, but they cannot prevent a third-party reservation-data incident. Soclyde keeps an encrypted vault on users’ devices rather than in a centralized cloud vault operated by Soclyde. See our guide to local and cloud password storage.
Key points
Several airlines reported passenger-data incidents associated with a shared reservation environment. Scope is airline-specific, so passengers should consult their carrier’s notice and verify unexpected booking messages through official channels.
