On Sunday, November 15, Caribbean Airlines officially issued a public statement confirming a recent unauthorized data access incident that compromised passenger booking and travel reservation records, linked to a security flaw in the infrastructure of its third-party reservation platform provider, Amadeus IT Group. The regional Caribbean carrier noted that it was first notified of the anomalous access event directly by Amadeus’ internal security teams, which detected the presence of an unknown external actor that successfully exploited an unpatched vulnerability in the widely used reservation service ecosystem. Initial forensic assessments completed by both the airline and Amadeus’ cybersecurity response teams have found no tangible evidence that sensitive payment card credentials were exfiltrated during the incident, with the scope of the confirmed breach currently limited to core booking itineraries, travel documentation details, and associated passenger contact information. This security event was not isolated to Caribbean Airlines alone: a roster of major global air carriers that rely on Amadeus’ reservation services, including Japan Airlines, Singapore Airlines, Cathay Pacific, Finnair, Thai Airways, Korean Air, and Qantas, have also confirmed they are reviewing potential impacts to their own passenger records. In the immediate aftermath of the disclosure, Caribbean Airlines stated that its top operational priority is rolling out targeted notifications to every passenger whose personal information may have been exposed, a outreach process that remains active and ongoing as investigators cross-reference affected user datasets. Amadeus’ technical teams have since fully remediated the original security vulnerability that was exploited, and have rolled out layered upgrades to their real-time threat monitoring and anomaly detection platforms to reduce the risk of comparable unauthorized access events in the future. Caribbean Airlines extended a formal public apology to its customer base for the anxiety and operational disruption caused by the data security lapse, and reaffirmed its longstanding policy of investing in safeguards to protect passenger personal data, though the carrier has not yet released verified figures on the total number of its passengers impacted, nor confirmed whether travelers with itineraries to or from Antigua and Barbuda are represented in the exposed records. The ongoing multi-party investigation, involving the airline, Amadeus, and independent cybersecurity forensics firms, is still in progress, with Caribbean Airlines committing to release all relevant additional updates to the public as soon as verified information becomes available. The incident has also sparked broader industry conversations about the systemic risks associated with shared third-party technology infrastructure that handles sensitive passenger data for dozens of international airlines, highlighting gaps in cross-carrier coordinated cybersecurity response protocols.
Caribbean Airlines confirms data breach affecting passengers’ booking information
