Malaysia Airlines Warns Customers of Amadeus Data Breach

Malaysia Airlines has issued an advisory warning that passenger information may have been compromised following a cybersecurity breach involving travel technology provider Amadeus. In an official statement issued on Sunday, the national carrier confirmed that customer data processed through Amadeus between August 2023 and September 2026 was potentially affected. Malaysia Airlines stressed that its own internal IT systems were not breached and confirmed there is no evidence indicating passenger financial details were accessed. However, travellers face heightened risks of phishing and unsolicited communications. The airline is actively investigating the incident alongside Amadeus.

Key Facts

The cybersecurity incident at Amadeus impacts airline booking systems worldwide, exposing passenger information handled across a multi-year period. While Malaysia Airlines' own internal networks remained uncompromised, records processed between August 2023 and September 2026 face potential exposure, joining breaches confirmed at Cathay Pacific and Japan Airlines.

The Amadeus incident potentially compromises passenger reservation records processed across a 37-month window between August 2023 and September 2026.

Which Malaysia Airlines Passengers Are Affected by the Breach?

The breach potentially affects Malaysia Airlines passengers whose travel details were handled through the Amadeus reservation platform between August 2023 and September 2026. While exact passenger counts remain undisclosed, customer information processed during this 37-month operational window was exposed via an unauthorised intrusion into Amadeus's booking display environment.

Amadeus operates as a critical global distribution system and reservation provider for international carriers and travel agencies. In its preliminary disclosure, the technology provider confirmed an unauthorised party gained access to a travel booking display environment. Malaysia Airlines confirmed that its core IT infrastructure was never breached and noted there is no evidence indicating passenger financial data or payment cards were accessed. The airline is actively liaising with Amadeus and relevant authorities to establish the precise scope of the compromise.

Malaysia Airlines confirmed that its internal IT systems were not breached and found no evidence of compromised customer financial data.

How Many International Airlines Have Been Impacted by Amadeus?

Malaysia Airlines is among multiple international carriers reporting customer data exposure stemming from the Amadeus reservation system intrusion. Confirmed affected regional operators include Cathay Pacific and Japan Airlines, which disclosed compromises impacting approximately 53,000 bookings and 92,000 customers respectively, alongside South Korea's Asiana Airlines.

Reuters reported that Amadeus acknowledged the security flaw last month after detecting unauthorised access to its booking display environment. Although Amadeus has not published an aggregate global total of affected passenger records, disclosures from major Asia-Pacific airlines demonstrate the wide reach of the vulnerability across partner carrier networks.

Independent disclosures reveal that the Amadeus security breach compromised approximately 53,000 bookings at Cathay Pacific and 92,000 customer records at Japan Airlines.

What It Means for Malaysian Buyers

Malaysian travellers who booked flights with Malaysia Airlines between August 2023 and September 2026 face an increased risk of targeted phishing rather than direct financial fraud. Because financial systems were not compromised, existing flight tickets and bookings remain valid, but passengers must monitor incoming messages for suspicious requests.

Malaysia Airlines has urged passengers to remain vigilant against unsolicited communications, particularly phone calls, messages, or emails asking for personal credentials or banking details. With passenger reservation records potentially exposed, bad actors may craft deceptive communications impersonating airline staff or ticketing agents. Local travellers should verify all booking-related queries directly through official airline touchpoints.

Malaysian passengers should exercise heightened vigilance against unsolicited messages requesting personal or payment details following the Amadeus incident.

Common Questions

This FAQ addresses passenger data safety, affected booking timeframes, and recommended security actions following the Amadeus reservation platform breach. While Malaysia Airlines' core IT systems remained intact, passengers with bookings made between August 2023 and September 2026 must take precautions against fraudulent communications.

Was passenger financial or credit card information exposed?

No evidence indicates that financial information was compromised in the incident. Malaysia Airlines confirmed that its own IT infrastructure remained secure, with the vulnerability isolated to Amadeus's booking display environment rather than direct airline banking or payment processing channels.

Which booking period is potentially affected by the breach?

The incident potentially affects customer data processed through Amadeus between August 2023 and September 2026. Travellers who booked tickets or whose reservation records were handled by travel agents using Amadeus during this 37-month window fall within the affected timeframe.

What steps should Malaysia Airlines passengers take now?

Passengers should monitor communications closely and disregard unsolicited emails, phone calls, or messages requesting personal or financial information. Malaysia Airlines advises travellers to verify any booking change or refund notice directly through official customer service channels before sharing sensitive information.

Passengers flying with Malaysia Airlines between August 2023 and September 2026 are advised to monitor for unsolicited communications following the Amadeus breach.

Sources and Methodology

This report compiles official disclosures released by Malaysia Airlines alongside reporting from Reuters and Lowyat.NET on 2 November 2026. All booking statistics, affected operational timeframes, and infrastructure security assessments were verified against primary statements, with no currency conversions required as no financial transaction figures were reported.

• Malaysia Airlines official statement (issued Sunday, 1 November 2026).
• Lowyat.NET reporting by Heirul Kamel (published 2 November 2026).
• Reuters reporting on Amadeus passenger reservation system disclosures.

All details in this dispatch were verified against carrier and vendor disclosures on 2 November 2026.