Key Notes
- Qantas is assessing the impact of unauthorised access at Amadeus and says its own systems and databases remain secure.
- Cathay Pacific has disclosed about 53,000 affected bookings, while Qantas and Malaysia Airlines have not disclosed comparable totals.
- The Amadeus incident is separate from Qantas’ 2025 contact-centre breach, and passengers should follow airline-specific notices.
Qantas is investigating whether customer bookings were affected by unauthorised access at Amadeus, adding an Australian dimension to a reservation-data breach involving several major airlines. The carrier says its own systems and databases remain secure while it works with the technology provider to establish the impact.
The distinction matters for passengers: Qantas has confirmed that it was notified about the supplier incident, but the report does not establish how many Qantas bookings were affected or which data fields may have been accessed.
What Qantas Has Confirmed
In a statement to NewsWire, a Qantas spokesperson confirmed that Amadeus had advised the airline of unauthorised access to one of its systems. According to Qantas, the supplier said the issue was contained in September.
The airline is working with Amadeus to assess the effect on its bookings. It has notified the Australian Cyber Security Centre and the Office of National Cyber Security. NewsWire also reported Amadeus’ position that there was no evidence of access to payment records or financial data.
Different Airlines Have Reported Different Impacts
Amadeus supplies reservation technology across the travel industry, which means a single supplier incident can lead to separate investigations and customer notices at multiple carriers. The figures disclosed by one airline do not describe the entire incident.
Cathay Pacific’s official notice puts its affected total at around 53,000 bookings. Most contained booking references, passenger names and flight details. A smaller subset potentially included additional contact, travel-document or frequent-flyer information.
Cathay says its own systems and operations were unaffected. It also says Amadeus took containment measures, including a password reset and enhanced monitoring, and had not identified evidence that the affected data had been misused.
We previously covered Malaysia Airlines’ warning about information processed through Amadeus between August 2023 and September 2026. That airline has not disclosed an affected-customer count. Its data-processing window should not be treated as proof that all bookings during those years were exposed.
This Is Separate From Qantas’ 2025 Incident
The current Amadeus disclosure is separate from the Qantas contact-centre incident first announced in July 2025. The airline’s earlier incident page concerns customer data held on a third-party servicing platform used by a Qantas contact centre.
Figures, notification letters and advice associated with that earlier case should not automatically be applied to this investigation. Passengers receiving a message about their information should check which incident it refers to and what the airline says was involved.
How Passengers Can Check Their Position
For an individual traveler, the useful information is whether their records were involved and which details were affected. Booking references, contact information and identity-document details create different concerns, so an airline-specific notice is more useful than a combined headline about several carriers.
The Office of the Australian Information Commissioner’s consumer guidance says people who believe they may be affected but have not been notified can contact the organisation and ask whether their personal information was involved.
Use contact details reached through the airline’s official website or app when checking an unexpected request. Do not treat a message demanding urgent payment or personal details as genuine simply because it refers to a widely reported breach.
What to Watch for Next
The next material updates will be the scope of any Qantas booking exposure, the information involved and any direct instructions to affected customers. The airline’s statement that its own databases remain secure is distinct from the question of what happened to records processed by its supplier.
Passengers should follow their own carrier’s notices, monitor bookings through official channels and act on any verified instructions about their information.
Disclaimer: TravelCapybara is an independent media brand owned and operated by NuvexMedia LLC, publishing travel news, destination guides, research, and insights. NuvexMedia LLC may invest in or collaborate with companies across the travel, hospitality, technology, and digital media sectors. These relationships do not influence TravelCapybara’s editorial coverage. While we strive for accuracy, travel requirements, prices, schedules, availability, and local conditions may change without notice. Readers should independently verify information before making travel or purchasing decisions. This content is for informational purposes only and does not constitute professional advice. © 2026 NuvexMedia LLC. All rights reserved.
