Caribbean Airlines has confirmed a data security incident affecting passenger reservation records following a breach at its third-party service provider, Amadeus IT Group, S.A. According to an official media release issued by the airline on November 15, 2026, an unauthorized party exploited a software vulnerability within the Amadeus infrastructure to gain unauthorized access to booking and travel information.
The security compromise extended beyond the Caribbean carrier, impacting multiple major international airlines that rely on Amadeus IT Group, S.A. for reservation processing. Among the affected global carriers named in the official release are Japan Airlines, Singapore Airlines, Cathay Pacific, Finnair, Thai Airways, Korean Air, and Qantas.
Caribbean Airlines sought to reassure customers regarding the nature of the exposed records, highlighting that preliminary assessments from Amadeus indicate no payment card data was accessed. The unauthorized access was confined strictly to passenger travel itineraries and booking details, leaving financial information secure.
The airline stated that its primary concern remains directly notifying customers affected by the breach, an effort that is currently ongoing. For its part, Amadeus has remediated the vulnerability and upgraded its monitoring and threat-detection capabilities to protect network integrity moving forward.
Reaffirming its commitment to safeguarding personal data and upholding security standards, Caribbean Airlines issued a formal apology to its passengers for the concern and inconvenience stemming from the third-party breach.
