Weekly Digest: Amadeus breach hits Asian airlines, Agoda goes AI

The Amadeus breach reached airlines in Japan, Hong Kong and Korea this week, while Agoda put its AI assistant and a five-year hotel growth deal into one APAC story. Here are the five stories that mattered.

Airlines: the Amadeus breach spreads

Japan Airlines said a breach at Amadeus exposed the names, booking references and flight information of 92,000 customers. For about 2,000 of them the records also included passport numbers, frequent-flyer numbers, emails and phone numbers. Amadeus notified JAL on 23 October 2026 that unauthorised access to its Passenger Service System ran from 10 August 2023 to 23 September 2026. Cathay Pacific said about 53,000 bookings were affected, ANA said up to 37,800 passengers were affected, and Korean Air and Condor also reported impact. Jin Air detected a separate breach on 28 October that exposed the data of 1,454 members and reported it to Korea’s Personal Information Protection Commission. Why it matters: Amadeus serves more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels, and it had disclosed a vulnerability in its travel booking display environment on 1 October. A breach window of more than three years sits inside a vendor, not inside the airline.

OTAs: Agoda’s AI assistant moves booking into chat

Agoda’s AI Assistant, first tested in September, is now live in 21 markets in its mobile app. It is the first new booking experience in Agoda’s 20-plus year history, and it combines chat planning with live inventory of more than 6 million accommodations plus flights and activities. It runs on OpenAI models for conversation and uses Gemini with Google Maps Grounding for restaurants and points of interest. Beta users were more likely to book a connected trip of several product types. Why it matters: an OTA that sells the hotel, the flight and the activity in one conversation raises the value of every booking, and it sets the bar for what travellers will expect elsewhere.

Hotels: H World and Agoda sign for five years

H World Group Asia Pacific and Agoda signed a five-year strategic cooperation. H World APAC targets about 70 hotel openings over the five years, with Agoda providing market intelligence, investor introductions, location assessment and distribution. Murphy Zhu, President of H World Group Asia Pacific, describes H World as the world’s fourth-largest hotel group by room count. Why it matters: a hotel group of that size is buying more than distribution from an OTA. It is buying help choosing where to build.

Destinations: Azerbaijan courts Asia

PATA and the Azerbaijan Tourism Board signed an MOU to strengthen tourism connections with Asia Pacific. Azerbaijan opened a tourism board office in Beijing this year and has visa-free travel with China, Japan and Korea. Why it matters: three of Asia’s largest outbound markets can reach Baku without a visa, and the board now has a desk in one of them.

Funding: travel tech hits a multiyear low

Travel tech startups raised US$2.2B across 302 rounds in the first three quarters of 2026, Crunchbase News data shows, against US$3.7B in all of 2025. On dollars and deal count, 2026 may be the lowest year for travel tech funding since at least 2018. Why it matters: capital is scarce for travel founders, so the vendors that hotels, airlines and OTAs rely on will be judged harder on security and on proof of revenue.

The week ahead

WTM London runs 3 to 5 November 2026 at Excel London. The 2025 show drew 46,500 attendees, and its Travel Tech exhibitor area grew 55%. The travel-tech and AI-distribution sessions are where this week’s themes, vendor risk and selling through AI, go on stage.