KUALA LUMPUR – A sweeping cybersecurity breach at global travel-tech giant Amadeus has potentially exposed three years of passenger booking data linked to Malaysia Airlines Bhd (MAB), the national carrier confirmed.
The vendor-level compromise puts sensitive customer records handled over an extensive 37-month window directly in the crosshairs.
“The incident may have affected certain customer information processed through Amadeus between August 2023 and September 2026,” MAB announced in an advisory published on its website Saturday.
Scrambling to contain customer alarm, the airline emphasized that its internal IT infrastructure remains intact, with preliminary findings suggesting payment details were spared.
“There is no evidence so far that financial information has been accessed,” MAB noted, while stressing that its proprietary servers were not directly breached.
The exposure leaves affected fliers vulnerable to phishing and identity-harvesting scams, prompting the carrier to urge heightened customer caution.
“We are treating this matter with the utmost seriousness and are working closely with Amadeus and relevant parties to investigate the incident and assess its impact,” the airline stated.
“As a precaution, we encourage customers to remain vigilant against suspicious or unsolicited communications, particularly those requesting personal or financial information.”
Reiterating that customer privacy and data security remain its primary obligation, MAB confirmed that internal containment reviews with Amadeus are ongoing, with further disclosures expected as forensics develop. – November 1, 2026