Malaysia Airlines Warns of Data Exposure in Amadeus Breach as Asian Carriers Scramble

Malaysia Airlines said Saturday that some customer information may have been affected by a cybersecurity incident at Amadeus, the third-party provider that runs its reservation system, adding the carrier to a widening list of Asian airlines caught up in the breach.

The national flag carrier said in a statement that the incident may have affected certain customer information processed through Amadeus between August 2023 and September 2026. It stressed that its own information technology systems had not been compromised and that there was no evidence so far that financial information had been accessed.

"We are treating this matter with the utmost seriousness and are working closely with Amadeus and relevant parties to investigate the incident and assess its impact," the airline said. As a precaution, it encouraged customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information.

The statement did not specify how many customers may be affected, what types of personal data were involved, or when and how the breach was discovered. Malaysia Airlines said protecting customers' privacy and information remained its foremost priority and that it would provide further updates as more information became available.

Wider breach hits Asian carriers

Malaysia Airlines joins Cathay Pacific Airways, Japan Airlines, South Korea's Asiana Airlines and others that in recent days have reported customer data was compromised in the Amadeus breach. Amadeus said it had become aware of a vulnerability affecting a travel booking display environment but did not respond to a question on how many customers' data were affected.

In recent days, Cathay Pacific and Japan Airlines reported that the breach had affected data involving 53,000 bookings and 92,000 customers, respectively. Amadeus notified affected carriers of the data breach starting in late October.

Amadeus is one of the world's largest providers of reservation and distribution technology to airlines and travel agencies. Last month, it was disclosed that the company suffered a cybersecurity incident involving unauthorized access to its passenger reservation systems. The breach affected multiple airlines, primarily in Asia, including Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific, Malaysia Airlines, and Star Flyer.

Third-party risk in focus

The incident underscores the aviation sector's heavy reliance on cloud and third-party services, and highlights the risk-laden role of supply chains in the industry. Amadeus offers reservation, ticketing, and flight management solutions to more than 1,000 airlines, with systems covering flight scheduling, seat management, ticketing, and customer relationship management.

According to public information, the security vulnerabilities at Amadeus primarily involved unauthorized API access permissions, which allowed attackers to read and download customer databases. If such vulnerabilities are not promptly patched, they can have long-term negative impacts on customer privacy and corporate reputation.

Malaysia Airlines warned that personal identification information, contact details, and certain credit card data may have been illegally accessed, though specific details regarding the leaked data were not disclosed.

Compliance and reputational fallout

The breach may trigger compliance reviews under data protection regulations in various countries. If the leaked data includes sensitive personal information, Malaysia Airlines may be required to report to regulatory authorities and provide remedial measures to affected customers in accordance with the European Union's General Data Protection Regulation (GDPR) or China's Personal Information Protection Law (PIPL).

The airline said it will work with its legal and information security teams to assess potential legal risks and develop response strategies.

Since its establishment in 1998, Malaysia Airlines has maintained "safety and reliability" as the core of its brand, but has faced several challenges in recent years, including the 2014 plane crashes and the 2018 flight delays. The data breach may trigger a crisis of customer trust on top of those prior difficulties.

The industry widely calls for the establishment of stricter security audit standards, enhanced multi-layered protection mechanisms, and the formulation of rapid response procedures to reduce the likelihood of similar incidents in the future.