One Vendor, Seven Airlines, Three Years Undetected

In late October, Japan Airlines disclosed that booking data for approximately 92,000 customers had been compromised. The airline was not hacked. Its own systems were not breached. The problem was Amadeus, the travel technology company that processes reservations for roughly half the world's airlines. An attacker had been inside Amadeus's booking display environment since August 2023, and nobody noticed until September 2026.

Japan Airlines was not the only carrier affected. Within days, Singapore Airlines confirmed about 46,000 booking records were exposed. Cathay Pacific reported approximately 53,000. ANA disclosed roughly 37,800. Korean Air, Asiana, Qantas, Malaysia Airlines, and Condor were also named. The combined tally from the four airlines that have published numbers already exceeds 228,000 records, and more carriers are still assessing their exposure.

No payment data was taken. But reservation codes, passenger names, flight dates, routes, and travel classes were all accessible. For a smaller subset of passengers, passport numbers and frequent-flyer details were also exposed.

The Real Story Is Not the Breach. It Is the Three Years.

Amadeus told its airline clients that it detected the vulnerability on September 24, 2026. The unauthorized access window, though, stretched back to August 10, 2023. That is more than 1,100 days of exposure. Through a single vendor's system, an attacker could quietly read booking data across multiple global airlines for three full years.

This is not an anomaly. It is the logical consequence of vendor concentration. Amadeus provides mission-critical reservation, inventory, and departure control software to approximately 200 airlines worldwide. Its Air IT Solutions division holds an estimated 50 percent global market share. When that one system has a vulnerability, the blast radius is not one company. It is an industry.

What Boards Should Take Away

If your company depends on a vendor that also serves your competitors and your entire sector, you have a concentration risk that no amount of compliance paperwork will resolve. The question is not whether your vendor has a SOC 2 report. The question is: if that vendor were compromised today, would you know?

In Cyber Risk Is Business Risk, I frame this through the Three Questions that every board should be able to answer about their organization's cybersecurity posture. The Amadeus breach puts a sharp point on two of them.

"Can we detect when something has gone wrong?" None of the affected airlines detected this breach. Amadeus detected it, more than three years after the access began. The airlines learned about it when Amadeus told them. If your vendor is your only line of detection, you have no line of detection.

"How quickly can we respond and recover?" JAL disclosed the breach five days after Amadeus notified it. That is a reasonable disclosure timeline. But the damage was already done across three years of access. Speed of response means nothing when the intruder has been reading your data since 2023.

Vendor Risk Is Not a Checklist Exercise

Most organizations manage third-party risk through questionnaires and annual reviews. They ask vendors to attest to their security posture, collect a SOC 2 Type II report, and move on. That process would not have caught this. Amadeus presumably passed every audit during the three years the attacker was inside its system.

The problem is that these programs measure what the vendor says about itself. They do not measure what is actually happening inside the vendor's environment. The gap between those two things is where breaches live.

For boards and executives, the Amadeus breach should prompt a different set of questions about critical vendors:

• Do we know which vendors hold our customer data, and how much? Not what they told us during procurement. What they actually hold today, in production and in archived systems.
• Do we have any visibility into anomalous access within our vendors' systems? Or are we entirely dependent on the vendor noticing and telling us?
• What is our concentration risk? If one vendor serves us and six of our peers, a single breach becomes an industry event. Is that risk reflected anywhere in our risk register?
• What does our contract require in terms of breach notification speed? Amadeus detected the issue in September and began notifying airlines in late October. Is a month acceptable for your business?
• Do we have a response plan for a breach we did not cause and cannot investigate? When the breach is in your vendor's environment, your forensics team has no access. Your response plan needs to account for that dependency.

What to Ask Your CISO This Week

Bring this story to your next board or executive meeting and ask three specific questions. First: which of our critical vendors, if breached, would affect our customers at scale? Second: for each of those vendors, what detection capability do we have that is independent of the vendor telling us? Third: when was the last time we tested our response plan for a third-party breach, where we have no direct access to the compromised systems?

The answers will tell you more about your organization's actual risk posture than any quarterly compliance dashboard.

The airlines did nothing wrong in how they handled the disclosure. But they spent three years trusting a system they could not see into. That is the business risk that boards need to own.