Warning for Qantas passengers as global airline booking giant suffers data breach

Australians who have made an airline booking recently should be "especially cautious" about receiving suspicious messages or calls following a data breach affecting multiple airlines.

Amadeus, a booking software company used by airlines around the world including Qantas, Korean Air, Asiana, Japan Airlines, ANA and Cathay Pacific, has been involved in a data breach.

The organisation confirmed certain booking-display data had been accessed through a vulnerability.

They said there was no evidence that payment or financial data was accessed, though investigations are ongoing.

"There are no indications that this vulnerability has been exploited for ransomware purposes," said the organisation, headquartered in Spain.

Qantas confirmed they had been advised by Amadeus that there had been unauthorised access to one of their systems.

"Amadeus advised the issue was contained in September and we're working with them to understand the impact to any Qantas bookings," a Qantas spokesperson told Explore.

"There is no impact to Qantas systems or databases which remain secure."

Alex Jenkins, director of the WA Data Science Innovation Hub at Curtin University, said though there is no evidence that payment or financial data was accessed, it might take further time for the full extent of the breach to be documented.

"Cathay Pacific says around 53,000 bookings were affected. Most involved booking references, passenger names and flight details. Japan Airlines was also impacted," Jenkins said.

"Qantas says it is working with Amadeus to establish the impact on its bookings and that its own systems and databases remain secure. We don't know yet what Qantas customers (if any) had information accessed."

Jenkins said travel information like booking-display data is enough for a scammer to impersonate an airline and ask you to make a payment or provide more personal information.

"My main concern for Qantas customers is the possibility of targeted scams based on their travel information," Jenkins said.

"Knowing the details of your trip does not prove that a caller or message is genuinely from your airline or travel agent."

He wasn't aware of any evidence that data from this breach has resulted in any successful scams for any airline customers just yet, but this would "take some time to identify".

He said customers should be on the lookout for suspicious messages.

"Be especially cautious about unexpected messages, calls or emails claiming your flight has changed, offering a refund or requesting an extra payment," Jenkins told Explore.

"Talk to your travel agent if you use one about how they will communicate with you."

If you do receive a suspicious message, open the airline's app or website yourself, or call a number you know is correct, rather than following a link in the message.

"Never share passwords or one-time security codes. Stay vigilant," Jenkins said.