.png)
When the Booking System Is Breached, the Airline May Not Be the Entry Point
The Amadeus incident shows how a weakness at a technology provider can expose passenger information across multiple airlines, even when their own IT systems remain uncompromised.
ITSEC Asia
Booking a flight involves more technology than most passengers ever see. Behind the confirmation email are reservation platforms, passenger service systems and integrations that help airlines manage bookings, ticketing and check-in.
That interconnected structure is now at the centre of a cybersecurity incident involving Amadeus, a global travel technology provider.
On 4 November 2026, Reuters reported that Singapore Airlines said approximately 46,000 booking records may have been affected by unauthorised access to data held on Amadeus' platform. The information reportedly included customer names, booking references, travel itineraries and booking classes. For around 620 records, additional details such as email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been accessed. [1][2]
Singapore Airlines said its own IT systems had not been breached. It also reported that no bookings had been changed and that bank account and credit card information had not been exposed.
The disclosure follows reports from other airlines. Japan Airlines said approximately 92,000 customers may have had reservation information accessed, while Cathay Pacific reported around 53,000 affected bookings. ANA and Malaysia Airlines have also disclosed potential exposure involving the same technology provider. [3][4][5]
The figures refer to different airlines and record types, so they should not be added together as a single confirmed number of affected passengers.
The risk behind a connected booking ecosystem
Airlines rely on external technology providers for critical functions. Reservation platforms may process passenger names, travel dates, flight details and booking references. These systems need to exchange information with airline applications and operational processes.
That creates a third-party risk question: how well can an organisation protect information once it is processed outside its own network?
A company can maintain strong internal security controls and still face exposure through a supplier's environment. This is why vendor assessments should go beyond reviewing contracts and compliance certificates. Organisations need visibility into data flows, access permissions, authentication, system integrations and incident notification procedures.
The Amadeus incident also highlights the sensitivity of booking references and travel details. Even when payment data or passwords are not involved, exposed information can help criminals craft convincing phishing messages, impersonate service providers or target travellers with fraudulent booking updates.
What organisations should do
A practical third-party security programme should include:
-
Map data flows: Know what information is shared with each provider and where it is stored or processed.
-
Review access: Limit supplier access to the systems and data required for their services.
-
Test the digital attack surface: Assess exposed applications, interfaces and access paths within the authorised scope.
-
Monitor supplier risk: Establish clear security requirements, incident reporting channels and regular reassessments.
-
Prepare for misuse: Develop customer communication and response procedures for potential data exposure.
Where AI-assisted penetration testing fits
Third-party risk assessments need evidence of how digital environments behave under attack. Reviewing policies is useful, but organisations also need to identify weaknesses in the applications, interfaces and access paths that connect their systems.
This is one area where Bronyx AI, ITSEC's AI-assisted autonomous penetration testing platform, can support authorised security testing. It can help organisations assess their digital attack surface and identify weaknesses that may otherwise remain undiscovered during routine reviews.
AI-assisted testing does not replace supplier due diligence, access governance or incident response. It adds a technical assessment layer to help organisations understand their exposure and validate security controls.
The Amadeus incident is a reminder that an organisation's security boundary extends beyond its own infrastructure. Every provider connected to sensitive data or critical processes deserves scrutiny.
Know your exposure. Test your defences. Secure your digital ecosystem.
Learn more about Bronyx AI and ITSEC's AI-assisted penetration testing capabilities.
References
-
Reuters, Singapore Airlines says 46,000 booking records affected by Amadeus breach, 4 November 2026. Read article
-
Channel News Asia, About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus, 3 November 2026. Read article
-
Japan Airlines, Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response, 30 October 2026. Read statement
-
Reuters, Cathay Pacific says Amadeus breach affected 53,000 bookings, 30 October 2026. Read article
-
Malaysia Airlines, Cybersecurity Incident Involving Third-Party Technology Provider, 31 October 2026. Read statement
