What should travel agencies do about the Amadeus booking data exposure?

Last week, airlines started writing to their customers. Japan Airlines said about 92,000 customers had booking data exposed through a flaw at Amadeus, the travel technology company. Cathay Pacific followed two days later with about 53,000 bookings. The records span bookings made from August 2023 to September 2026.

Many agencies book through Amadeus, and every agency books on airlines that run on it. Here's what is known so far, and the steps we'd take this week.

What happened at Amadeus?

Amadeus says it found a vulnerability in "a travel booking display environment." Certain booking data was readable through it. It has fixed the flaw and added monitoring and detection. It's also talking with customers and authorities. It says it has seen zero evidence that payment or financial data was accessed, or that ransomware was involved.

The German tech outlet heise reported the flaw on October 13 after readers alerted it. Its first technical analysis points to a heap dump from a web application. The dump was reachable by anyone who found it, and it held access credentials and tokens. Amadeus told heise it learned of a potential vulnerability on September 21.

What data was exposed?

Booking records. For about 90,000 Japan Airlines customers, that meant the booking reference, the name, flight dates, routes and travel class. For about 2,000 more, the record also held contact details, passport numbers, nationality and frequent flyer numbers.

Cathay Pacific describes the same pattern. Most records held the booking reference and the passenger's name with flight details. Some also held contact details or travel document numbers. heise says the records it could see included dates of birth and passport data, searchable by last name.

Which airlines and agencies were affected?

Japan Airlines and Cathay Pacific have published counts. BleepingComputer reports that Korean Air and Asiana confirmed impact, and that ANA announced a breach tied to Amadeus. heise says many of the records it checked were Lufthansa and Condor bookings.

Agencies come into it as well. heise found hundreds of travel agency office IDs in Germany among the retrievable data. Amadeus has yet to publish a full list of affected airlines or agencies, and BleepingComputer's questions on scope were still unanswered at publication.

Why does this matter to a US agency?

Because a real booking reference, a real name and a real flight make a convincing scam. A traveler who gets an email quoting their exact trip is likely to trust it. Expect phishing that asks travelers to "confirm" a card or re-enter passport details.

Corporate clients will ask, too. Their security teams read the same news, and the next questionnaire may ask which GDS you use and what you did about this.

What should an agency do this week?

1. Ask Amadeus about your office IDs. If you book through Amadeus, ask your account manager in writing whether your pseudo city codes or office IDs were in scope, and what Amadeus recommends.
2. Tell travelers how you ask for payment. Send one plain note: your agency asks for card details by one route, and anything else should be checked by calling you.
3. Look up affected trips. Pull bookings on Japan Airlines and Cathay Pacific from August 2023 to September 2026. Those travelers may get airline notices, and a short note from you first helps.
4. Review who signs in. Check the GDS and portal accounts your team holds. Close the ones for people who've left, and turn on two-step sign-in where it's offered.
5. Write your client answer now. A few sentences on what you asked Amadeus and what you told travelers. Our post on the security questions corporate clients ask covers the rest of the questionnaire.

What's still unknown?

The full scope. Amadeus is yet to publish how many airlines and agencies were affected. Its investigation is still running. The cause rests on heise's first technical analysis for now. Check Amadeus's statement page for updates, and watch for notices from other airlines over the next few weeks.

Common questions