Compliance

Amadeus breach: lessons for Malaysian CIOs and DPOs

nPro Team · 3 November 2026 · 4 min read

The Amadeus reservation breach exposed passenger data at Malaysia Airlines and other Asian carriers. What it means for third-party risk and PDPA breach notification in Malaysia.

On 31 October, Malaysia Airlines told customers that some of their personal information may have been exposed. Its own systems were not breached. The exposure happened at Amadeus, the third-party provider that runs its reservation system. For CIOs and data protection officers, it is a clear reminder: your data can leak from a system you do not operate.

What happened

Amadeus detected unauthorised activity in its travel booking environment in September 2026 and began notifying airlines in October. Asiana and Cathay Pacific both said an unauthorised party used login credentials assigned to a system account in Amadeus's environment. Records created between August 2023 and September 2026 were accessed.

The carriers named so far are mainly in Asia: Malaysia Airlines, Cathay Pacific, Japan Airlines, All Nippon Airways, Korean Air and Asiana Airlines. Cathay said about 53,000 bookings were involved. Japan Airlines and its subsidiary JTA reported about 92,000 passengers, of whom about 2,000 also had passport numbers viewed. In most cases the data was names, booking references and flight details. A smaller number of records included email addresses, phone numbers and travel document details.

Malaysia Airlines has not said how many of its customers are affected. It says there is currently no evidence that financial information was accessed, and it has urged customers to watch for suspicious messages. Amadeus has reset the affected password and strengthened monitoring, and says it has not found evidence that the data has been misused.

Why it matters for organisations in Malaysia and ASEAN

Based on what has been disclosed, the airlines' own systems were not attacked. One account at one shared vendor gave access to three years of records across several countries. Most organisations in the region now depend on SaaS platforms, outsourced IT and cloud processors in the same way.

Malaysia's amended PDPA raises the stakes. Since 1 June 2025, data controllers must notify the Personal Data Protection Commissioner of a breach within 72 hours, and affected individuals within seven days of that notice where significant harm is likely. Since 1 April 2025, data processors are directly bound by the Security Principle, and maximum fines have risen to RM1 million. A breach at your vendor is still your notification problem, and you can only report quickly if your vendor tells you quickly.

Five practical takeaways

  1. Map where your personal data actually lives. List every vendor that stores or processes customer or employee data, and what categories they hold. You cannot assess impact on data you did not know was there.
  2. Check your processor contracts. Make sure vendors must notify you of breaches promptly and help with your PDPA notifications. Agree a time frame that leaves you room inside the 72-hour window.
  3. Treat service accounts as high-risk identities. Inventory system and integration accounts, rotate their credentials, restrict what they can reach and alert on unusual use. Ask your key vendors how they do the same.
  4. Minimise and expire data. Three years of booking history was available in one place. Keep only what you need, for as long as you need it, and push vendors to do the same.
  5. Prepare for the phishing that follows. Leaked names and booking details make convincing lures. Brief staff and customers early, and watch for related phishing reaching your own users.

How a self-hosted platform like nPro helps

No tool can secure a vendor's environment for you. What you can control is your own estate, and the data that flows from it. nPro DLP includes sensitive data discovery to show where personal data sits on your endpoints, and blocks risky movement through USB devices, cloud uploads, clipboard and screen capture. nPro SIEM and XDR bring login and endpoint events into one dashboard, so unusual account activity on your systems is easier to spot. Because nPro is self-hosted, on-premises or in your chosen cloud, those logs and findings stay on your infrastructure.

Find out what your exposure looks like

Start with visibility. nPro's free 30-day Data Exposure Audit shows where sensitive data sits across your endpoints and how it moves, so you can fix gaps before a breach forces the question. Request your Data Exposure Audit.

Frequently asked questions

Was Malaysia Airlines hacked in the Amadeus breach?

No. Malaysia Airlines says its own IT systems were not compromised. Customer information processed through Amadeus, its third-party reservation provider, between August 2023 and September 2026 may have been affected.

Does a Malaysian company have to report a breach that happens at its vendor?

Under the amended PDPA, the data controller must notify the Personal Data Protection Commissioner within 72 hours of a personal data breach, and affected individuals within seven days of that notice where significant harm is likely. Controllers should require processors by contract to report breaches to them promptly.

How can organisations reduce third-party data breach risk?

Know which vendors hold which personal data, limit and expire what they keep, secure service account credentials, set breach reporting duties in contracts, and monitor your own systems for unusual account activity and phishing that follows a leak.

Sources

Related reading

See how nPro implements this

The documentation covers configuration, agent deployment and the current status of each capability.

View documentation More articles