Qantas Airways

Summary

Qantas Airways confirmed customer records were exposed after unauthorised access to a booking system operated by global travel technology provider Amadeus, though the airline's own systems and databases were not affected. The breach impacted multiple airlines globally, with accessed data including booking references, passenger names, flight details, and in some cases email addresses, phone numbers, travel document numbers, and frequent flyer details, while no payment or financial information was reported as compromised. It reported the matter to relevant Australian cyber authorities and is working with Amadeus to understand the impact to its bookings.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A data breach at global travel technology provider Amadeus IT Group exposed customer records belonging to Qantas Airways and at least three other airlines. Amadeus, headquartered in Madrid, disclosed that one of its booking systems had been subjected to unauthorised access. The company’s airline technology platforms handled more than 2.2 billion passenger boardings in 2025 according to its global report. Qantas was notified by Amadeus regarding the issue and subsequently reported the matter to the Australian Cyber Security Centre and the Office of National Cyber Security. A Qantas spokesperson confirmed that Amadeus advised the issue was contained in September and that the airline was working with the provider to understand the impact to any Qantas bookings. The spokesperson stated that Qantas’ own systems and databases had not been affected by the intrusion. None of the affected airlines had their own systems compromised, with the exposure originating entirely within Amadeus infrastructure. The unauthorised access to the Amadeus booking system ran from August 2023 to September 2026, spanning more than three years before the issue was contained.

Cathay Pacific disclosed on October 30, 2026, that approximately 53,000 bookings had been affected by the breach. The accessed data mostly included booking references, passenger names, and flight details, while in a smaller number of cases email addresses, phone numbers, travel document numbers, and frequent flyer details were also compromised. Japan Airlines reported that 90,000 customers had basic booking information exposed, while 2,000 had passport numbers and frequent flyer numbers compromised. Malaysia Airlines confirmed that customer records were involved but stated that no financial data had been accessed. No airline reported that payment or financial information was part of the breach. Amadeus confirmed that it had taken actions to contain the incident, including a password reset, and had implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus had not identified evidence that the affected data had been misused.

Qantas said it had been working with Amadeus to understand the impact to any Qantas bookings following the notification. If personal information belonging to Australian residents is confirmed as compromised in the Amadeus incident, mandatory notification to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme would apply.

Sources

Sources available to members: 1 source.