What Malaysia Airlines has confirmed
Malaysia Airlines says certain customer information processed through its reservation-technology provider, Amadeus, may have been affected by a cybersecurity incident. Its notice is dated October 31, 2026; the period it identifies runs from August 2023 to September 2026.
According to the airline, its own IT systems were not compromised and it has found no evidence of financial information being accessed. It is investigating the impact with Amadeus.
What remains unknown
The Malaysia Airlines notice gives neither a customer count nor a breakdown of the information involved. Those details remain unconfirmed.
Cathay’s separate account
In an October 30 notice, Cathay Pacific says approximately 53,000 bookings were affected at Amadeus. This is a count of bookings, not passengers.
Most accessed records included booking references, passenger names and flight details. A smaller subset potentially included contact details, travel-document information or frequent-flyer numbers. Cathay reports no evidence of financial or payment data being accessed.
Cathay says its own systems and operations were unaffected. It plans to contact affected customers individually after establishing the relevant details.
What customers are being told
Malaysia Airlines advises customers to watch for suspicious or unexpected messages, especially requests for personal or financial information, and says it will publish further updates.
These two notices do not provide a complete list of affected airlines or an Australia-specific customer total.
