Key Takeaways

  • Qantas is assessing whether customer booking information was exposed through unauthorised access to an Amadeus system.
  • Qantas says its own systems remain secure, while Amadeus has found no evidence that payment or financial data was accessed.
  • The incident highlights the concentration and third-party risks surrounding shared aviation technology infrastructure.

Qantas is investigating whether customer booking data was affected by unauthorised access to a system operated by travel-technology provider Amadeus, bringing the airline’s exposure to third-party cyber risk back into focus.

The airline has said its own systems and databases remain secure. Amadeus, meanwhile, has reported no evidence that payment or financial information was accessed. Those distinctions matter because they narrow the immediate scope of the incident, but they do not yet settle whether passenger records held within the affected system were viewed or extracted.

According to Information Age, Qantas notified the Australian Cyber Security Centre and Australia’s National Office of Cyber Security while assessing the potential effect on bookings. The investigation is likely to focus on what information the Amadeus system contained, which users had access and whether unusual activity extended beyond the initially identified environment.

There are no indications that the vulnerability was exploited for ransomware. However, ransomware is only one possible outcome of unauthorised access; attackers may instead seek customer information that supports phishing, identity fraud or further social-engineering attempts.

Airline booking data can be useful even when it excludes card numbers. Names, contact details, travel dates, destinations and loyalty information can help criminals create convincing messages that appear to relate to a genuine trip. A fraudulent itinerary update or payment request may look far more credible when it includes details known only to the traveller and companies involved in the booking.

The new investigation is separate from Qantas’s 2025 breach involving a third-party contact centre. The Office of the Australian Information Commissioner reported that approximately 5.67 million customer records were compromised in that incident. The affected records included names, contact details and Frequent Flyer information. About 1.7 million also contained addresses, birth dates, gender or meal preferences.

The OAIC found that the 2025 incident followed phone-based social engineering, commonly called vishing, targeting an employee of an overseas provider. Its preliminary inquiries did not indicate that Qantas had failed to take reasonable security measures. Still, the episode showed how an airline’s security posture can be affected by the controls, identity processes and employee practices of companies connected to its operations.

Amadeus represents a different kind of dependency. The company serves around 141 global airlines, according to Cyber Daily, making it part of a relatively concentrated layer of infrastructure used across the aviation sector. When a widely shared platform experiences an intrusion, the possible effects can cross multiple brands and jurisdictions. One compromised environment may prompt investigations at numerous customers, even if each airline’s internal network remains untouched.

Airlines operate through dense networks of reservation platforms, airports, ground handlers, loyalty programs, call centres and technology suppliers. Data needs to move quickly between them, often across national borders and through systems built at different times. That connectivity supports efficient travel, but it also creates more identities, interfaces and vendor relationships for defenders to monitor.

The International Air Transport Association reported that aviation cyberattacks increased 600% in 2025 compared with 2024. While that figure covers a broad range of attacks, it illustrates why supplier assurance is becoming a board-level operational issue rather than a procurement checklist.

For Qantas and other airlines, the practical response extends beyond checking whether a supplier holds a security certification. Contractual notification periods, data inventories, access restrictions, incident exercises and independent testing can all help reduce uncertainty. Controls based on NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022 can provide useful structure, particularly when responsibilities are divided across several companies.

Frameworks alone do not remove concentration risk. Airlines must maintain a clear picture of which critical processes depend on shared providers and what alternatives exist if access has to be restricted. The immediate question is whether Qantas booking information was exposed, but the broader business priority is how quickly aviation companies can identify and contain risk when an affected system belongs to a third party.