Three years inside Amadeus shows who really holds your staff’s travel data

Kiwi firms book their people onto Qantas, Cathay Pacific and other Asia-Pacific carriers on the assumption that the airline is the custodian of the booking. The Amadeus breach shows otherwise. The data sat with a technology vendor most boards could not name, and someone was inside one of its systems for roughly three years.

The NZ Herald reported on Monday that Qantas, Cathay Pacific, Korean Air, Asiana, Japan Airlines, ANA and Malaysia Airlines have all been caught up in a cyber incident at Amadeus, the global travel technology provider that sits underneath a large share of the world’s airline bookings.

The airlines were secure, the bookings were not

Qantas’s statement is a neat summary of the issue. Amadeus told the airline there had been “unauthorised access to one of their systems”, the problem was “contained in September”, and there is “no impact to Qantas systems or databases, which remain secure”. All of that can be true and customers can still be exposed.

Cathay Pacific has been the most specific. Its statement confirms about 53,000 bookings were affected by access that ran between August 2023 and September 2026. For most, the data was booking reference, name and flight details. For a smaller group it extended to email, phone numbers, travel documents and frequent flyer numbers. Cathay says there is no evidence payment information was accessed, and no evidence so far that the data has been misused.

That is reassuring on fraud. It is less reassuring on everything else. Names, itineraries and passport details for travelling executives are exactly the raw material for targeted phishing, invoice fraud and impersonation. An attacker who knows your CFO is flying to Hong Kong on Thursday has a very credible pretext for an urgent email.

Second vendor failure, same ecosystem

This is not a one-off. In July the Office of the Australian Information Commissioner published its report into the June 2025 Qantas breach, in which about 5.67 million customer records were compromised through a social engineering attack on a third-party contact centre. The regulator found Qantas appeared to have taken reasonable steps to protect the information and oversee its contractor.

Read that as a business owner and the implication is uncomfortable. A well-resourced company can do things properly and still have its customers’ data walk out through a supplier. In 2025, I’mTech reported that the earlier breach ran through a Manila call centre on cloud software, connected to a Salesforce loyalty database that was in turn tied to a legacy Amadeus-based reservation system used by thousands of airlines and agencies. The same vendor shows up in both stories.

The Australian Financial Review’s James Turner made the point bluntly at the time. In 2025 he wrote that “the lesson here isn’t that the airline failed”, but that most companies lacked the visibility to avoid the same fate.

Concentration risk nobody priced in

Aviation’s weakness was well signposted. In 2025, WTW’s John Wadhams and Jamie Monck-Mason warned that airline data is “legitimately passed between carriers, airports and other third parties”, creating multiple entry points, and that an IT estate is only as strong as the weakest link in its supply chain. BlueVoyant’s Kash Sharma, then managing director, said the same year that organisations “can’t always see or control the cyber standards of every partner” in their ecosystem.

New Zealand is not insulated. The National Cyber Security Centre’s 2025 Cyber Threat Report noted that while local organisations had avoided a high-profile breach of their own, NZ customers were hit by overseas breaches such as Qantas. It describes third-party attacks as exploiting suppliers whose security falls short of the target’s own standards. That is the Amadeus incident in one sentence.

What travel buyers should do this week

None of this calls for new regulation. It calls for procurement that actually asks questions. Most corporate travel contracts are negotiated on fares, rebates and change fees. Few include any due diligence on the booking engines, distribution systems and loyalty platforms that hold staff data, largely because the business never signs with those vendors directly.

Practical steps are cheap. Ask your travel management company which global distribution systems and platforms hold your bookings, and what breach notification it has committed to. Tell staff who flew affected carriers since 2023 to treat unexpected messages about bookings or frequent flyer accounts with suspicion. Brief finance teams that a plausible email quoting a real itinerary is now a realistic fraud vector. And add travel data to the third-party risk register if it is not already there.

Amadeus says the incident is contained, and the airlines say their systems are clean. Expect more carriers to disclose affected booking numbers in the coming weeks, and regulators on both sides of the Tasman to keep asking where accountability sits when the contractor, not the brand, is the point of failure. The businesses that come out of this well will be the ones that stop assuming the logo on the boarding pass is the company holding the data.

Sources

• NZ Herald: Airlines including Qantas, Cathay Pacific impacted in Amadeus cyber attack (2026-11-02)
• Cathay Pacific: Personal data security incident involving a third-party service provider (2026-10-30)
• OAIC: Report into preliminary inquiries of Qantas (2026-07-16)
• I’mTech: Qantas hack, the truth emerges, but it is not from Qantas (2025-07-23)
• AFR: Why the Qantas hack should send chills around corporate Australia (2025-07-14)
• SecurityBrief: BlueVoyant’s warning after Qantas and Mango cyber attacks (2025-10-24)