Malaysia Airlines warns customers after breach at reservation provider Amadeus

1 November 2026 · News · Tech & digital

Malaysia Airlines said on 31 October that some customer data handled by its reservation provider Amadeus between August 2023 and September 2026 may have been exposed; its own systems were not breached. For Malaysian companies, it is a reminder that a supplier's platform can leak your customers' data even when your own IT is secure, so vendor security reviews belong in every IT and cybersecurity contract.

What happened

Malaysia Airlines (MAS) issued a statement on 31 October 2026 saying a cybersecurity incident at Amadeus IT Group, the third-party company that runs its airline reservation system, may have affected some customer information. The data in question was processed through Amadeus between August 2023 and September 2026, a window of roughly three years.

The airline said its own IT systems were not compromised and that there is currently no evidence financial information was accessed. It has not said how many customers are affected or which types of personal data were involved, and said it would share updates as the investigation continues.

MAS is one of several Asian carriers caught up in the same incident. The New Straits Times reported that Cathay Pacific put the number of affected bookings at about 53,000, mostly booking references, names and flight details, while Japan Airlines and Japan Transocean Air cited about 92,000 customers and All Nippon Airways about 37,800. Korean Air and Asiana Airlines also reported unauthorised access to reservation data.

What customers are being told

MAS asked customers to stay alert to unsolicited messages, especially any that ask for personal or financial details, because leaked booking data can make phishing messages look more convincing. According to Cathay Pacific, Amadeus has reset passwords and added extra monitoring, and had found no evidence of misuse at the time of reporting.

Why it matters for businesses buying IT and security services

The incident did not start inside the airline. It started at a supplier that processes customer data on the airline's behalf. Most Malaysian companies now rely on similar outside platforms for bookings, payments, payroll, CRM and e-invoicing, so the same risk applies at a smaller scale.

Buyers reviewing their IT support, cloud or cybersecurity arrangements can use this as a prompt to list which suppliers hold customer or employee data, check how quickly each supplier must notify them of an incident, and confirm who handles customer communication if something goes wrong. Our how-to on reviewing a supplier's data security after a third-party breach covers the practical steps.

Map which outside platforms store or process your customers' personal data.
Check the incident-notification clause in each contract.
Agree in advance who drafts and sends customer notices after a breach.

Related rankings and guides

Sources

Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach — Malay Mail
Malaysia Airlines says IT systems unaffected by Amadeus data breach — New Straits Times

Editorial summary written by Best Malaysia Services. Not legal, tax or financial advice; check the original sources.