PENTESTY · EDITORIAL ANALYSIS · · 5 min read
Amadeus: defining access to booking data
The Amadeus notices describe customers and bookings with different scopes. For businesses, the response needs to connect the data involved, who could query it and the evidence of containment.
By Pentesty
Two notices, two measures of impact
In an October 30, 2026 notice, JAL and Japan Transocean Air reported traces of external access to data concerning approximately 92,000 customers in Amadeus’s system. About 90,000 involved basic booking fields; another 2,000 included additional information such as contact and passport details. The stated period runs from August 10, 2023 to September 23, 2026.
Cathay Pacific also reported approximately 53,000 affected bookings on October 30. It described booking references, names and flight details, with additional fields potentially accessed in a smaller subset. The company stated there was no evidence of access to financial or payment information. These October accounts concern earlier access; this analysis’s publication date does not establish when the incident began.
Start the response with a verifiable scope
For a business arranging travel, the first step is to connect the notice to the contracted service. Identify the provider, the internal owner, the booking datasets involved and the period covered by the investigation. Separate confirmed fields from those still being assessed. A notice concerning part of a database should not become a conclusion about every traveller or every integration.
Customers and bookings are different units, and the notices provide no combined deduplication. Record the unit and method before consolidating figures. For each field, identify the operational need and its recipients. The analysis of data minimization in identity verification helps distinguish necessary information from a complete document copy.
Give the technical account a boundary and an owner
Cathay attributes the information about system-account credentials to Amadeus and mentions a password reset as part of containment. The notice does not explain how those credentials were obtained. In the proposed assessment, ask the service owner to connect the account, its purpose and permitted operations, with a contact able to explain the limits of the available evidence.
In an environment authorized with the provider, or a controlled simulator, prepare fictional bookings and identities. Compare a permitted query with one the role should not perform. Then remove the test identity’s access and check a new query. Record the account, time and outcome using minimized data. The exercise should neither query real passengers nor change production bookings.
Communicate with context without creating another copy
JAL advised vigilance against fraudulent communications impersonating its group. The travel team can agree with security and customer support on a known channel for checking messages about the incident. Define which information is sufficient to advise the traveller and who approves sending it. Avoid reproducing documents or complete travel details in a widely distributed report.
Consider internal data recipients and records needed for investigation as well. Define access, retention and exceptions with the responsible owners, preserving what the investigation requires. The Trezor and ShipMonk analysis complements this work: a measure affecting access and an assurance about deleting copies answer different questions.
Accept the outcome of the workflow actually exercised
Keep the expected rule before testing and compare the responses obtained. The legitimate query needs to continue working in the authorized environment, while the revoked path should produce the expected denial. If part of the assessment depends entirely on a provider’s declaration, record that dependency and the next accountable owner. Investigating claims involving third parties provides criteria for separating statements from observations.
Acceptance should identify the dataset exercised, the permissions verified and the remaining gaps. A current test can demonstrate that workflow’s behaviour; it cannot independently reconstruct the contents of past access. Service availability and data confidentiality also need their own evidence. Use those distinctions to choose the next step, without turning a bounded assessment into a general security guarantee.
Frequently asked questions
Can customers and bookings be added into a single total?
Keep the units separate. The notices provide no combined reconciliation allowing those counts to be treated as a total of unique people.
Do the notices identify a CVE or explain how the credentials were obtained?
The cited documents identify no CVE and do not explain how credentials were obtained. The reference to a system account should retain its attribution.
Does resetting a password close the investigation?
Connect the measure to the access it was intended to contain. Verify the outcome within the authorized scope and retain historical questions that remain unanswered.
Are real bookings needed to assess the control?
The proposal uses fictional information and identities in an authorized or simulated environment. It requires neither access to passenger data nor changes to real bookings.
Sources and references
Original Pentesty analysis, published November 5, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.