Information Age (Australian Computer Society) reported on 4 November 2026 that Australia's Qantas is assessing potential data exposure after third-party travel-tech provider Amadeus suffered a cyberattack that has also been linked to other airlines.

In a statement given to Information Age, a Qantas spokesperson said Amadeus told the airline there had been 'unauthorised access' to one of the tech provider's systems; when asked whether any Qantas customer data was affected, the spokesperson said the airline was working with Amadeus to 'understand the impact to any Qantas bookings', that 'Amadeus advised the issue was contained in September', and that 'There is no impact to Qantas systems or databases which remain secure.'

Information Age says Qantas has notified the Australian Cyber Security Centre (ACSC) and the National Office of Cyber Security of the breach.

According to Information Age, Amadeus said it had become aware of a 'vulnerability affecting a travel booking display environment' that made 'certain booking-display data' accessible; Amadeus said there is no evidence payment or financial data was accessed, no indications the vulnerability was exploited for ransomware, that the vulnerability has been fixed, and that it has enhanced monitoring and is in dialogue with customers and authorities.

Information Age also reports that other carriers confirmed as affected include Singapore Airlines, Korean Air, Asiana, Japan Airlines, All Nippon Airways and Cathay Pacific; Cathay Pacific said unauthorised access occurred between August 2023 and September 2026 and that about 53,000 of its bookings were affected (mostly booking references, passenger names and flight details, with a smaller subset involving email, phone, travel document and/or frequent flyer numbers); Japan Airlines figures on this card are those Information Age restates (about 90,000 customers). Cyberstack already carries a Japan Airlines–focused card on the same Amadeus incident; this card covers the Australian Qantas statement and Amadeus wording as Information Age reports them. (source: Information Age / ACS)