Malaysia Airlines says IT systems unaffected by Amadeus data breach

KUALA LUMPUR: Malaysia Airlines Bhd said its own IT systems have not been compromised, although a cybersecurity incident involving its third-party technology provider, Amadeus IT Group, S.A. (Amadeus) may have affected certain customer information.

The national carrier said there is currently no evidence that financial information has been accessed.

"The incident may have affected certain customer information processed through Amadeus between August 2023 and September 2026."

"We wish to reassure customers that Malaysia Airlines' own IT systems have not been compromised, and there is currently no evidence that financial information has been accessed," it said in a statement on its website.

Malaysia Airlines has not disclosed how many customers may have been affected or the types of personal information potentially accessed.

The incident comes as several international airlines have reported unauthorised access to passenger reservation data held by Amadeus, a Spain-based travel technology company that provides reservation and other technology services to hundreds of airlines worldwide.

On Oct 30, Cathay Pacific said in a statement that some 53,000 of its bookings were affected by unauthorised access to passenger reservation data held by Amadeus.

The Hong Kong-based airline said most affected records included booking references, passenger names and flight details. A smaller number of records may also have included email addresses, phone numbers, travel document information and frequent flyer numbers.

Cathay Pacific said there was no evidence that financial or payment information had been accessed, while its own systems and flight operations remained unaffected.

"Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems."

"To date, Amadeus has not identified evidence that the affected data has been misused," Cathay Pacific said, adding that the incident does not affect its systems or operations.

Other airlines affected by the incident include Japan Airlines and Japan Transocean Air, which reported that about 92,000 customers were affected, while All Nippon Airways (ANA) said information relating to about 37,800 customers had been accessed.

South Korea's Korean Air and Asiana Airlines have also reported unauthorised access to customer reservation information through Amadeus but have not disclosed the number of affected customers.