On 4 November 2026 The Record reported that beyond Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines also disclosed incidents tied to a vulnerability in an Amadeus booking-display environment. Disclosed scales include tens of thousands of records per airline with names, flight details and in some cases travel documents. Amadeus says there is no evidence payment data was accessed or ransomware used, and that it fixed the flaw.

What it means: For Greek firms with frequent Asia travel, the follow-up widens the notice perimeter: staff booked on these airlines should treat PNRs/contact data as exposed and watch for “itinerary change” phishing. Travel desks should coordinate with TMCs on upcoming flights and locator changes where requested. The incident highlights concentration risk in global PSS providers—corporate travel contracts should demand third-party transparency and notice terms. Security teams should add airline-themed phishing indicators. Amadeus statements do not point to payment-card dumps, but passport/email loss raises social-engineering risk. Reinforce “no click on flight-change links” and verification via official apps. Travel-tech builders should treat this as a software supply-chain case study on third-party platforms. In practice, teams should name an owner, update the risk register and agree success criteria within 30 days. Where suppliers or customers are affected, send a short notice that points to the primary source and avoids overstated claims. Compliance, cybersecurity and payments operations are linked; a change in one area often requires a pass over contracts, access rights and continuity plans. Finally, keep a review date so the item becomes concrete actions for the Greek business rather than newsletter noise alone.

Read the original on The Record

Related service: Custom software

Related stories