The facts

  1. Malaysia Airlines identifies information processed through Amadeus between August 2023 and September 2026 as potentially affected. This is a data-processing window, not a confirmed duration of intrusion. [1][3]

  2. Reuters reports that Amadeus acknowledged a vulnerability in a travel-booking display environment; the overall affected-customer count was not supplied. [2]

  3. Cathay Pacific reported about 53,000 affected bookings and Japan Airlines about 92,000 customers, according to Reuters. Those different measures are not added into a unique-person total. [2]

  4. Malaysia Airlines says it is investigating with Amadeus and advises customers to watch for unsolicited requests for personal or financial information. [1]

  5. Japan Airlines says Amadeus notified it and Japan Transocean Air on 23 October. JAL reports traces affecting about 90,000 customers’ reservation/name/flight fields and about 2,000 customers with additional contact, passport and other details, for about 92,000 JAL customers total; it reports no credit-card numbers or passwords were compromised. [4]

Still unconfirmed

  • The full cross-airline scope, affected Malaysian customer count, entry method and complete data categories remain unresolved.

Corrections & updates

Substantive update, 2 November UTC: added Japan Airlines’ primary notice, which specifies its own 92,000-customer total and distinguishes the approximately 90,000 reservation/name/flight records from about 2,000 records with additional personal fields. The figure is not added to other airlines’ counts; the broader incident scope remains unknown.

Sources

References support the numbered facts above. Source checks: 2 Nov 2026, 05:29 UTC.

  1. Cybersecurity incident involving third-party technology provider

    Malaysia Airlines · Primary source

    The full public airline notice was read. It does not display a publication date; independently reported statement timing is preserved separately.

  2. Malaysia Airlines says customers may be affected by Amadeus breach

    Reuters, via MarketScreener · Reporting · 1 Nov 2026

  3. Malaysia Airlines warns customers of exposure in Amadeus incident

    Malay Mail · Reporting · 1 Nov 2026

    The actual local report dates the airline statement to the preceding day, 31 October; publication day is not treated as the intrusion date.

  4. Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response

    Japan Airlines · Primary source · 28 Oct 2026

    Opened JAL notice: Amadeus notified JAL/JTA on 23 October; it describes about 90,000 customers with PNR/name/flight fields and about 2,000 with additional contact/passport/nationality/loyalty fields, total about 92,000. It says no card numbers or passwords were compromised.

Report a factual error