Australian and New Zealand travellers could be among those affected by a cyber security incident involving global travel technology provider Amadeus, with Qantas and Malaysia Airlines now raising concerns about the potential exposure of customer information.
The incident reportedly dates back to September 2026, but its potential impact is only now receiving wider public attention as airlines work to establish which customers and bookings may have been affected.
Qantas and Australian customers
Qantas has raised concerns about the incident and alerted the Australian Cyber Security Centre (ACSC) while investigating whether Australian customer booking information was exposed.
The airline has indicated that its own systems and databases remain secure, with the incident involving Amadeus infrastructure rather than a direct compromise of Qantas systems.
For Australian customers, the key question remains how many bookings and passenger records were accessible to the unauthorised party.
What about New Zealand customers?
There has not yet been a specific public confirmation of the number of New Zealand customers affected.
However, the incident has potential implications beyond the airlines that have already made public statements. Travellers from New Zealand using international airlines and booking services supported by Amadeus technology may also have had their information processed through the affected environment.
The absence of a New Zealand-specific notification should not necessarily be interpreted as confirmation that local travellers are unaffected.
Wider international exposure
The incident is not limited to Australian and New Zealand travellers. Other international airlines have also reported potential customer exposure, including:
- Malaysia Airlines: Confirmed that some customer information processed between August 2023 and September 2026 may have been affected.
- Cathay Pacific: Reportedly identified approximately 53,000 affected bookings.
- Japan Airlines: Reportedly identified approximately 92,000 affected customers, including some whose additional personal information was exposed.
The information potentially involved includes passenger names, booking references, flight details and, in some cases, additional customer information.
Delayed disclosure and unknown attribution
One notable aspect of this incident is the delay between the original compromise and the public identification of potentially affected customers. Although the incident reportedly occurred in September, airlines are only now working through the process of determining the extent of customer exposure.
There has also been no official public attribution released by Amadeus or law enforcement agencies identifying who was responsible.
For Australian and New Zealand travellers, the immediate concern is the potential use of exposed booking information in targeted phishing and travel-related scams. Booking references, passenger names and flight details could provide criminals with sufficient context to make fraudulent communications appear legitimate.
Customers should be particularly cautious of unsolicited emails, text messages or phone calls claiming to relate to flight bookings, payment issues, itinerary changes or refunds.
The investigation remains ongoing, and the full impact on Australian and New Zealand customers is not yet clear.
