Skip to content
TALAYINSIGHT
RegionEurope

MediumII Cyber Warfare & Critical Infrastructure30 October 2026, Friday

Three-year Amadeus breach exposes airlines' shared supplier risk

Cathay Pacific said 53,000 bookings were affected by unauthorised access to the systems of its technology provider, Amadeus. Japan Airlines reported about 92,000 passengers and ANA about 37,800; the affected records span August 2023 to September 2026.

Location: MADRID

The unauthorised party reached travel booking data using login credentials belonging to a system account. Cathay was notified on 28 October and received details on 29 October; JAL confirmed a similar notification on 23 October and ANA on 29 October. Korean Air and Asiana were also affected but gave no figures; Paddle Your Own Kanoo adds Condor to the list. Most records contain names, booking references and flight details, while a smaller share include contact details, travel documents and frequent flyer numbers. According to LOGON, about 2,000 JAL records may include passport numbers; this is the only outlet among the sources we reviewed to give that figure.

Amadeus has not published a total. Paddle Your Own Kanoo refers to about 200,000 passengers, while Aviation A2Z warns against adding up the figures. Amadeus is reported to have reset the password and, as of 31 October, found no evidence of misuse. The attacker's identity and method have not been disclosed; the social engineering theory is an unverified inference.

The critical detail for insurers is that none of the 5 airlines reported a breach of its own systems, and Cathay's flights were not disrupted. The loss therefore arises as notification and customer management costs, not business interruption. The real threshold would be the same provider halting operations: the Altéa platform provides sales, reservations and check-in services to more than 130 airlines. Insurance Business reported on 13 October that insurers are imposing sub-limits on contingent business interruption cover (lost income from a supplier failure) or charging extra premium for full limits; no limit figure was disclosed.

Pricing is moving the other way. According to the same report, global cyber premiums in the Marsh index fell 4% in the second quarter and have declined for 12 quarters. Verizon's 2026 report finds a third party involved in 48% of breaches. Whether the airlines have filed policy claims, and what contractual liability Amadeus bears, could not be verified.

Talay assessment

Bottom line

The incident is less a minor data breach than a concentration test, showing that more than 130 airlines depend on the same platform. For now the loss has stayed in notification costs, which insurers read easily. The thesis is that contingent cover is shrinking even as premiums fall. It would be refuted if a large policy paid out its full limit after a provider outage.

Likely effects

  • Cyber insuranceNegative1–6 months

    Clients concentrated on a single platform reinforce insurers' use of sub-limits and extra premium; cover quality can narrow even as headline premiums fall.

  • Airline supply contractsUncertain1–6 months

    Korean Air's demand for stronger safeguards from Amadeus increases pressure on carriers to write supplier audits into contracts.

  • Turkish companiesUncertain6 months+

    For companies that rely on a single software provider for critical services, contingent business interruption sub-limits emerge as a distinct balance sheet risk.

Possibilities, ranked

  1. 1
    Closed as a data breach55%

    Airlines complete individual notifications, no evidence of misuse emerges and the cost stays limited to notification.

    Watch: Whether Amadeus publishes a total count of affected records

  2. 2
    Regulatory file grows30%

    Supervisors in Japan, Korea and Hong Kong examine the provider separately and third-party audits become a rule.

    Watch: An official investigation into Amadeus announced by a data protection authority

  3. 3
    Scope widens15%

    More carriers report, misuse of passport data comes to light and claims move to insurers.

    Watch: The number of affected airlines exceeding the current list, or the data appearing on leak forums

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

  • Cathay bookings▼ 53,000
  • JAL passengers▼ ~92,000
  • ANA passengers▼ ~37,800
  • Altéa users▼ 130+ airlines

Sources

  1. Aviation A2Z — Cathay Pacific Confirms Data Breach Affecting 53,000 Bookings
  2. Paddle Your Own Kanoo — Major Software Provider Had a Data Breach For Three Years
  3. The Korea Times — Korean Air breach exposes blind spot in airline cybersecurity
  4. LOGON — One Breach, Many Airlines: What the Amadeus Incident Means for Supply Chain Risk in Asia
  5. Insurance Business — Cyber's soft market is masking a coverage squeeze
Share