Science & Tech · Cybersecurity · 1 hr ago
Amadeus booking-system flaw exposed airline passenger data
A flaw in Amadeus travel-booking software exposed passenger data linked to several airlines.
Amadeus provides systems that connect airlines, hotels and travel agencies, and the exposed records included flights involving Lufthansa, Condor and other carriers.
The records included names, birth dates and booking codes, as well as contact and passport details shown in plain text.
An accessible memory dump also contained login details and tokens, and administrator passwords could allow reading and changing data in the global system.
Amadeus says it has fixed the flaw, but its investigation is continuing and it has not said how many people were affected or whether anyone accessed the data.
The company said payment and financial data could not be retrieved, and travellers should be wary of messages asking them to verify card details, checking with their accommodation directly if unsure.
A flaw in an Amadeus travel-booking system exposed booking and passenger data from several airlines.
The accessible records included names, birth dates, booking codes, contact details, and identity and passport information.
Technical analysis found that an unauthenticated endpoint exposed a memory dump containing credentials and authentication tokens.
Amadeus said it fixed the flaw and strengthened its monitoring and detection systems.
It remains unclear whether unauthorised people accessed the data or how many passengers were affected.
- Who
- Passengers whose bookings were handled through the Amadeus system, including travellers on Lufthansa and Condor flights.
- What
- A security flaw made booking and passenger data accessible.
- When
- Amadeus said it was alerted on September 21. Heise published its report on October 13, 2026.
- Where
- In an Amadeus travel-booking system; technical analysis indicated the flaw was not limited to individual locations.
- Why
- An unauthenticated endpoint exposed a memory dump containing credentials and authentication tokens.
This story does not have two clearly opposing sides.
Amadeus said it was alerted to a potential vulnerability affecting a travel-booking display environment.
Amadeus said it had fixed the flaw and strengthened its monitoring and detection mechanisms.
Heise published its report on the exposed booking and passenger data.
- Affected system
- Amadeus travel-booking system
- Exposed data
- Names, birth dates, booking codes, contact details, identity details and passport details
- Access method
- Unauthenticated endpoint exposing a Spring Boot application heap dump
- Airlines mentioned
- Lufthansa and Condor, among other airlines and partner airlines
- Alert date
- September 21
What people are saying
potential vulnerability
that affected a display environment for travel bookings
Sources
Related news
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
VMware plans paid HyperArmor tool as patch releases speed up
Canadian cybersecurity executive arrested on federal extortion charges
Cyberattack affects 80 stores of French supermarket chain Co-operative U
Attackers target critical SonicWall SMA 1000 flaw days after disclosure
AI safety can draw on cybersecurity collaboration, technology veteran says
DNSSEC key change disrupts some healthcare connections to Germany’s TI
Zscaler adds Claude Mythos 5.1
Frontier AI models completed all eight industrial-control attack tests
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
