Amadeus breach sparks data probes at Qantas and major Asian carriers

Qantas has notified the Australian Cyber Security Centre of a breach at Spanish travel-technology provider Amadeus that occurred in September. The airline is now investigating whether customer booking information was exposed. Hotels and car hire companies worldwide were also caught up in the incident.

Amadeus, a Madrid-headquartered travel software provider whose systems process bookings for airlines and hospitality firms globally, confirmed unauthorised access to one of its platforms. The company said the issue was contained in September.

What did Amadeus disclose?

A Qantas spokesperson said the airline learned of the incident directly from the vendor. "We have been advised by global travel technology provider Amadeus that there has been unauthorised access to one of their systems," the spokesperson said.

"Amadeus advised the issue was contained in September and we're working with them to understand the impact to any Qantas bookings. There is no impact to Qantas systems or databases which remain secure."

Amadeus issued its own statement describing the technical nature of the compromise. The company said it discovered a vulnerability affecting a travel booking display environment, a component that shows reservation data to travel partners. Certain booking-display data was accessible through the flaw, the statement confirmed.

Which airlines are investigating?

The impact extends well beyond Australia's flag carrier. 7NEWS understands the following carriers are among those affected:

• Korean Air
• Asiana Airlines
• Japan Airlines
• ANA (All Nippon Airways)
• Cathay Pacific

Hotels and car hire operators across the globe were also embroiled in the attack, widening the potential scope of exposed reservation records across the travel supply chain.

Was payment or financial data accessed?

Amadeus said its investigation has found no evidence of that outcome. "Although our investigations continue, we can confirm that there is no evidence that payment or financial data was accessed," the company's statement read.

The vendor also addressed ransomware concerns directly. It said there are no indications that the vulnerability has been exploited for ransomware (malware that encrypts systems and demands payment) purposes.

What remediation has the vendor completed?

Amadeus said it has implemented measures to fix the vulnerability. The company also reported enhanced monitoring and detection capabilities across its environment as part of its response.

The investigation remains ongoing. Amadeus said it cannot yet rule out additional findings while its enquiries continue.

What should enterprise buyers take from this?

The incident illustrates concentrated third-party risk in the travel technology stack. A single vulnerability in one vendor's booking-display environment simultaneously drew investigations from carriers on at least three continents, plus hospitality and ground transport providers.

For Qantas, the immediate assessment is narrow: determine whether any Qantas bookings were affected and quantify any customer data exposure. The airline has confirmed its own systems and databases remain secure. The Australian Cyber Security Centre now holds formal notification of the incident, placing it within the national regulatory reporting framework for significant data breaches.