Malaysia Airlines flags customer data exposure in Amadeus breach; joins expanding airline fallout

KUALA LUMPUR — Malaysia Airlines said Sunday that some customer information may have been affected by a cybersecurity incident at Amadeus, its third-party reservation-technology provider, adding the national carrier to a widening list of Asian airlines reporting exposure from the breach.

The airline said the incident may have affected certain customer information processed through Amadeus between August 2023 and September 2026, a window of roughly three years. It stressed that its own information technology systems had not been compromised and that there was no evidence so far that financial information had been accessed.

“We are treating this matter with the utmost seriousness and are working closely with Amadeus and relevant parties to investigate the incident and assess its impact,” the airline said in a statement published Saturday.

As a precaution, Malaysia Airlines urged customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information — a common follow-on tactic after breaches, when criminals use leaked data to make phishing attempts more convincing.

The statement did not disclose how many customers may be affected, what types of personal data were involved, or when and how the breach was discovered. The carrier said protecting customers’ privacy and information remained its foremost priority and that it would provide further updates as more information became available.

Malaysia Airlines joins Cathay Pacific Airways, Japan Airlines, South Korea’s Asiana Airlines and others in recent days that have reported customer data was compromised in the Amadeus breach, according to Reuters. Cathay Pacific and Japan Airlines reported that the breach had affected data involving 53,000 bookings and 92,000 customers, respectively.

Amadeus said it had become aware of a vulnerability affecting a travel booking display environment but did not respond to a question on how many customers’ data were affected, Reuters reported.

Broader impact

Amadeus is one of the world’s largest providers of reservation and distribution technology to airlines and travel agencies, offering reservation, ticketing and flight management solutions to more than 1,000 airlines, according to the Central News Agency (CNA). Its systems cover functions including flight scheduling, seat management, ticketing and customer relationship management.

Last month, it was disclosed that Amadeus suffered a cybersecurity incident involving unauthorized access to its passenger reservation systems, affecting multiple airlines primarily in Asia, including Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific, Malaysia Airlines and Star Flyer, according to Malay Mail.

Amadeus notified affected carriers of the data breach starting in late October 2026, Malay Mail reported.

The incident underscores the aviation sector’s heavy reliance on cloud and third-party services and highlights the risk-laden role of supply chains in the industry, CNA reported. Public information indicates the security vulnerabilities at Amadeus primarily involved unauthorized API access permissions, which allowed attackers to read and download customer databases, according to CNA. If such vulnerabilities are not promptly patched, they can have long-term negative impacts on customer privacy and corporate reputation, the outlet said.

Regulatory exposure

Malaysia Airlines warned that personal identification information, contact details and certain credit card data may have been illegally accessed, though CNA did not disclose specific details regarding the leaked data.

If the leaked data includes sensitive personal information, Malaysia Airlines may be required to report to regulatory authorities and provide remedial measures to affected customers under the European Union’s General Data Protection Regulation (GDPR) or China’s Personal Information Protection Law (PIPL), CNA reported.

The airline said it will work with its legal and information security teams to assess potential legal risks and develop response strategies, according to CNA.

Malaysia Airlines has faced several challenges related to safety and service quality in recent years, including the 2014 plane crashes and the 2018 flight delays, CNA noted. The data breach may trigger a crisis of customer trust and prompt compliance reviews under data protection regulations in various countries, the outlet reported.

The industry widely calls for stricter security audit standards, enhanced multi-layered protection mechanisms and rapid response procedures to reduce the likelihood of similar incidents, CNA said.