A data breach at global travel technology provider Amadeus IT Group, headquartered in Madrid, is putting third-party vendor risk squarely in front of cyber insurance placements, after Qantas Airways and at least three other airlines confirmed customer records were exposed.
Amadeus, whose airline technology platforms handled more than 2.2 billion passenger boardings in 2025 according to the company’s global report, disclosed that one of its booking systems had been subjected to unauthorised access. None of the affected airlines had their own systems compromised.
For brokers, the commercial question at the centre of the incident is whether their clients’ cyber policies respond when the breach originates in a vendor’s infrastructure rather than the insured’s own network.
Qantas said it had been notified by Amadeus of the issue and had reported the matter to the Australian Cyber Security Centre (ACSC) and the Office of National Cyber Security.
“We have been advised by global travel technology provider Amadeus that there has been unauthorised access to one of their systems. Amadeus advised the issue was contained in September and we’re working with them to understand the impact to any Qantas bookings,” a Qantas spokesperson told News24.com.au.
The spokesperson said Qantas’ own systems and databases had not been affected.
Cathay Pacific disclosed on October 30, 2026, that approximately 53,000 bookings had been affected. According to the airline’s statement on the incident, the unauthorised access ran from August 2023 to September 2026, more than three years before the issue was contained.
The accessed data mostly included booking references, passenger names, and flight details. In a smaller number of cases, email addresses, phone numbers, travel document numbers, and frequent flyer details were also compromised.
“Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus has not identified evidence that the affected data has been misused,” Cathay Pacific said.
Japan Airlines said 90,000 customers had basic booking information exposed, while 2,000 had passport numbers and frequent flyer numbers compromised. Malaysia Airlines confirmed customer records were involved but said no financial data had been accessed.
No airline has reported that payment or financial information was part of the breach.
Read more: Qantas hackers threaten data release as insurers weigh fallout from cyber breach
The incident sits in the vendor risk gap that many cyber placements still do not adequately cover.
When a breach originates in a third party’s infrastructure, several policy questions arise at once. Does the insured’s first-party cyber cover respond, or does the claim depend on the vendor’s own insurance and contractual indemnities? Are sub-limits for dependent business interruption adequate, or are they set so low they offer little practical protection? And do notification clauses account for the delay between a vendor discovering an intrusion and informing its clients?
Joerg Schmitz, cyber risk quantification and analytics leader for APAC at Aon, noted in Aon’s 2025 Cyber Risk Report that “the most lucrative attacks are those that can be scaled across multiple targets through a single compromised supplier.”
The Amadeus breach fits that pattern. A single point of compromise cascaded across carriers in different jurisdictions simultaneously.
Vicky Sheridan, senior claims specialist for cyber at AXA XL in Australia, told Insurance Business on October 27, 2026, that the trend is accelerating. “We’re also seeing growing exposure to cyber risks arising from third-party technology providers,” Sheridan said.
The three-year window of unauthorised access, from August 2023 to September 2026, adds a further complication. For clients on claims-made policies, the gap between intrusion and discovery can determine whether a claim falls within the policy period at all.
Read more: Third-party breaches push brokers toward vendor risk
Broader data from the Office of the Australian Information Commissioner (OAIC) shows the scale of the problem nationally. Australia recorded 1,205 notifiable data breaches in calendar year 2025, an 8% increase on the prior year and the highest annual total since the scheme began in 2018. Malicious or criminal activity accounted for 716 of those notifications.
If personal information belonging to Australian residents is confirmed as compromised in the Amadeus incident, mandatory notification to the OAIC under the Notifiable Data Breaches scheme would also apply.
For brokers, vendor risk clauses, dependent business interruption triggers, and notification timelines all need scrutiny before the next renewal. The Amadeus breach did not touch any airline’s own systems, but the exposure reached clients whose insurance may not fully cover the fallout.
