The Airline Wasn't Breached. Its Passengers' Data Was [PART I]

HOW THIRD-PARTY TECHNOLOGY DEPENDENCIES CHALLENGE AVIATION CYBERSECURITY, ACCOUNTABILITY, AND PASSENGER TRUST

This three part series examines the growing cybersecurity and governance challenges created by aviation's dependence on interconnected technology platforms and third-party providers. Beginning with the Amadeus-related passenger data incident affecting several international airlines, the three installments explore the exposure of passenger information, the underlying technology and identity infrastructure, and the question of corporate accountability when critical systems are operated by external providers.

Part I examines the incident and its implications for passenger data and airline security. Part II explores the invisible infrastructure, machine identities, credentials, and monitoring behind modern airline operations. Part III addresses the governance, oversight, and accountability obligations that accompany those technology dependencies.

"ROCK ME AMADEUS" 

The cybersecurity incident involving Amadeus and several global carriers exposes a fundamental problem in modern aviation technology: the systems an airline depends upon may extend far beyond the systems it owns, but responsibility for passenger trust does not.

The airline says its systems were not breached. Its passengers' data was still exposed.

At first glance, those statements may appear contradictory. They are not. They describe one of the defining cybersecurity challenges of modern aviation.

In late October 2026, Cathay Pacific, Japan Airlines (JAL), All Nippon Airways (ANA), and Malaysia Airlines notified customers that personal information associated with reservations may have been accessed without authorization through Amadeus, a major technology provider supporting the global travel industry. The reported access period extended from August 2023 through September 2026.

The reported impact varied. JAL identified approximately 92,000 customers; Cathay Pacific reported approximately 53,000 bookings; ANA reported approximately 37,800 customers. Malaysia Airlines said customers may have been affected but did not publicly quantify the number. The categories of information also varied, with reservation details potentially involved for larger groups and additional personal or travel-document information for smaller subsets.

The numbers matter, but the more consequential question is what the incident reveals about where an airline's technology environment actually begins and ends. A passenger sees one airline. The technology supporting that passenger's journey may involve an ecosystem. That ecosystem is one of aviation's greatest strengths—and one of its most difficult security challenges.

THE AIRLINE IS NOT THE ENTIRE JOURNEY

To the passenger, an airline journey is singular. A ticket is purchased, a reservation confirmed, a boarding pass issued, and a flight departs. Behind that apparently simple experience, information may move through a complex network of technology platforms and organizations.

A passenger may book through one organization and fly on another. A reservation may be processed through a global technology platform. An itinerary may involve codeshare partners, connecting carriers, airports, ground-handling organizations, payment providers, loyalty programs, border authorities, and other entities. Baggage may travel across multiple organizations, while passenger information may be exchanged across national borders. A single journey can cross numerous operational and technological boundaries even though the passenger experiences it as one continuous trip.

This interoperability is one of aviation's greatest achievements. It allows a global industry composed of thousands of organizations to function as a connected transportation system. It is also a security challenge. Every organizational boundary can introduce another technology relationship, and every technology relationship raises questions about access, authentication, data handling, monitoring, and accountability.

The traditional image of cybersecurity—a company defending the walls around its own network—has therefore become increasingly inadequate. The modern aviation enterprise is not simply the collection of systems appearing on an airline's network diagram. It is an interconnected environment of systems, providers, partners, and services upon which the airline depends.

THE ANATOMY OF AN INDIRECT BREACH

Amadeus is not a peripheral contractor sitting somewhere outside the aviation business. Its technology supports fundamental travel and airline functions, including capabilities associated with passenger reservations and services. For many airlines, relying on major technology providers is a rational response to the extraordinary cost, complexity, and specialized expertise required to develop and operate global aviation systems independently.

A shared technology platform can provide economies of scale, standardized processes, interoperability, and capabilities that would be prohibitively expensive for many organizations to build and maintain themselves. But shared infrastructure also creates shared dependency, and shared dependency can create concentrated risk.

When multiple organizations entrust sensitive information to a common technology environment, a single security incident may affect multiple organizations without requiring each of their individual networks to be compromised. That appears to be the fundamental characteristic of the Amadeus-related incident. The available airline disclosures indicate that unauthorized access occurred within an environment operated by a third-party technology provider, while affected airlines emphasized that their own internal systems were not breached.

That distinction is technically important. It is not, however, the same as saying the airlines were unaffected. Their customers were affected, their passenger relationships were affected, and their brands were exposed to the consequences of an incident occurring within an environment upon which they depended.

The difference between technical ownership and enterprise responsibility suddenly becomes very real.

THE PASSENGER RECORD IS MORE THAN A TICKET

An airline reservation is not simply a passenger's name attached to a flight. Depending on the booking and the systems involved, a Passenger Name Record (PNR) can include a booking reference, passenger identity, itinerary, travel dates, flight segments, contact information, ticket details, seating information, and frequent-flyer information. In some circumstances, additional identity or travel-document information may also be present.

The airline disclosures illustrate why it is important to understand the affected datasets rather than simply count records. JAL reported that most affected customers had reservation-related information potentially accessed, while a smaller subset had additional information that included contact details, passport numbers, nationality, and frequent-flyer information. ANA described a similar division between basic reservation information and additional personal information. Cathay Pacific likewise distinguished between information associated with most affected bookings and more extensive information potentially involved in a smaller subset.

Not every affected passenger faces precisely the same risk. But the absence of compromised payment-card information should not be mistaken for the absence of meaningful consequences.

Travel information can be extraordinarily useful to a criminal or fraudster. Imagine receiving a message that appears to come from your airline and references your actual name, an upcoming flight, your destination, or a specific booking. A fraudulent message becomes considerably more convincing when the sender already possesses information that would normally establish credibility. An attacker does not necessarily need a credit-card number to exploit that trust.

Travel information can also reveal patterns of movement, business relationships, and periods when an individual may be away from home. Depending upon the person and circumstances, it may expose sensitive professional or personal activity. The value of the data is therefore not limited to conventional identity theft. A reservation is, in many respects, part of a person's life in motion.

THE BOUNDARY IS THE PROBLEM

An airline cannot assess its cybersecurity posture solely by examining its own infrastructure. It may maintain strong internal controls, protect its corporate network, and invest in security monitoring, yet still experience exposure through a technology provider supporting its core business.

The passenger does not distinguish between the airline's reservation system and the platform processing the reservation on its behalf. Nor should the passenger have to. The relationship is with the airline, and the information was supplied to support the airline's service.

That is the first lesson of this incident: the security perimeter of a modern airline is not necessarily the perimeter of its own network.

But recognizing that the perimeter extends beyond the airline's direct control raises a more difficult technical question. If access occurs within a shared technology environment, how is that access established, how is it monitored, and how can an organization distinguish legitimate system activity from unauthorized use of apparently legitimate credentials?

Those questions take us beyond the boundaries of networks and into the identities that connect them.

In Part II, “The Invisible Infrastructure Behind Every Airline,” we will examine machine identities, service accounts, authentication, monitoring, and the reported access period extending from 2023 to 2026. The question is not simply how access may have been obtained, but how an apparently legitimate identity can remain a security risk without being recognized as one.