All Nippon Airways: Passport and Booking Data of 37,800 Customers Exposed Through Amadeus Contractor Breach

All Nippon Airways (ANA) has confirmed that booking data for about 37,800 customers was viewed after an attacker got into the passenger service system run by its contractor, Amadeus IT Group, which is based in Spain. ANA says about 1,700 of those customers also had their passport numbers and nationalities exposed. The airline says the activity ran from August 10, 2023 to September 23, 2026. That is more than three years of reservations sitting in reach of an intruder. No card details or passwords were involved. ANA is the latest airline to disclose a breach through Amadeus, after Japan Airlines, Korean Air and Asiana. It has also warned three smaller Japanese carriers that use the Amadeus system through ANA that their passengers may be affected too.

What Happened

ANA first said on October 29 that a contractor's system had been accessed without authorization and that some reservation records showed signs of outside viewing. At that point the airline had not yet counted the affected customers. It gave the figure of roughly 37,800 on October 30, as reported by Kyodo News, Aviation Wire and TRAICY.

The timeline ANA has published raises questions about how the vendor told its customers:

• August 10, 2023 to September 23, 2026: the period in which ANA says reservation data was viewed. Japan Airlines gives the same window for its own records.
• September 24, 2026: Amadeus detected unauthorized access to airline reservation data. ANA says Amadeus did not tell it at the time.
• October 1, 2026: Amadeus posted a statement saying it had found a vulnerability in its travel booking display environment that could expose traveler data. BleepingComputer reports that the statement said ransomware actors had not exploited the flaw and that no payment data was exposed.
• October 16, 2026: ANA heard that other airlines using Amadeus had confirmed unauthorized access, and asked Amadeus whether its own flight reservation data was affected.
• October 20, 2026: Amadeus told ANA that unauthorized access had been detected. ANA reported the incident to Japan's Personal Information Protection Commission and other relevant parties. Korean Air and Asiana were told the same day, according to Japan Cyber Watch's summary of Asiana's notice.
• October 23, 2026: Amadeus notified Japan Airlines, which disclosed its breach on October 28.
• October 29 to 30, 2026: ANA disclosed the breach, then gave the number of people affected.

Reading ANA's account, the airline learned its data had been hit because it asked the vendor directly after hearing about other airlines. Amadeus does not appear to have told ANA on its own initiative. Amadeus has not publicly responded to ANA's version of events.

The breach also reaches past ANA's own passengers. Aviation Wire reports that Air Do, Solaseed Air and Star Flyer, which all use the Amadeus system through ANA, said on October 29 that ANA had told them their customers' personal data showed signs of being viewed. Star Flyer's own notice confirms this. It says the carrier is working with ANA to work out the scope and will contact affected customers once that is known. It is not clear whether the 37,800 figure includes passengers of these partner airlines. Kyodo describes the affected group as customers who booked flights operated by ANA.

What Was Taken

ANA's figures are the same across every report. Kyodo, TRAICY and Aviation Wire all give a total of about 37,800, made up of two groups:

ANA says the records contained no credit card information or passwords. Amadeus told ANA it had found no evidence of ransomware, or of data being changed or deleted.

On wording: ANA describes the exposure as "evidence of viewing" (参照された形跡). Kyodo's headline says the data "leaked". The airline has not said whether data was copied out in bulk, and no one has claimed publicly to have the data or to be selling it.

The 1,700 extended records matter most. A passport number, nationality, phone number, email address and frequent flyer number together give a fraudster everything needed to send a convincing message pretending to be the airline. That is especially true when the message can quote a real booking reference and flight. JAL's breach has the same two-group structure. About 90,000 JAL customers had basic booking data exposed and about 2,000 had the fuller set including passport numbers, which points to the same access method and the same parts of the system.

Why It Matters

This breach shows how much risk can sit in a single supplier. BleepingComputer reports that Amadeus runs reservation, ticketing and check-in systems for more than 400 airlines. So far, four large carriers in Japan and South Korea and at least three smaller Japanese airlines have said they are affected. Joho no Todai notes that the full impact may go beyond the airlines that have disclosed so far.

Three points for defenders:

1. Airlines could not see the breach from their side. The access happened inside Amadeus's environment. ANA, JAL and Asiana all say their own systems were not breached. None of them could have spotted more than three years of viewing with their own monitoring.
2. Notification depended on the customer asking. Amadeus detected the access on September 24, but by ANA's account it only gave ANA details after ANA raised the question on October 16. Any company relying on a supplier's contract to guarantee prompt notice should test whether that actually works.
3. The data is useful for targeted fraud. Real booking references and flight details make phishing very convincing. ANA plans to contact affected customers in stages from next week and has warned them about fake emails, phone calls, websites and social media ads pretending to be the ANA Group.

The Attack Technique

The exact method has not been fully confirmed, and the public accounts point two different ways.

• A vulnerability: BleepingComputer reports that Amadeus's October 1 statement described a vulnerability in its travel booking display environment. The outlet links JAL's confirmed breach to that flaw being exploited.
• Stolen or misused login credentials: Asiana's notice, as summarized by Japan Cyber Watch, says the access used login credentials assigned to an account in Amadeus's system. Korean Air's notice is reported to say the same. ANA says Amadeus told it the credentials involved have been invalidated and monitoring has been strengthened.

These accounts could both be true. A flaw in the display layer could have let an attacker use, or go beyond, a valid account's access. But Amadeus has not published a technical explanation that links them. The activity lasting more than three years points to access that looked like normal use, which fits a valid account better than noisy exploitation.

No threat actor has been named. Escudo Digital notes that the X account H4ckmanac drew early attention to the incident, but no group has claimed the attack. Amadeus has said it found no sign of ransomware.

What Organizations Should Do

1. Ask your platform providers directly. If you rely on a shared vendor for core systems such as passenger service, payroll or booking, don't wait to be told. ANA only got confirmation after asking. When a supplier reports a breach affecting any of its customers, send it a formal written question about your own data.
2. Make vendor notification terms concrete. Contracts should require notice within a fixed number of hours of detecting a breach on any shared system, with no exception for "still investigating." They should also give you the right to see access logs for your own records.
3. Ask for access logs for your data on the vendor's side. Require shared platforms to provide regular reports of which accounts read your records and how many. Look for unusual read volumes or accounts reading records far outside their normal pattern.
4. Review the credentials you hold on vendor systems. Rotate and audit any accounts your staff, agents or partners use on the vendor's platform. Require multi-factor authentication, and remove accounts that are inactive or more powerful than they need to be.
5. Warn customers before scammers reach them. Tell affected customers exactly what your company will and won't ask for, such as passport details or payment by phone. Watch for lookalike domains and fake ads using your brand.
6. Map your downstream partners. ANA's breach reached Air Do, Solaseed Air and Star Flyer because they use the system through ANA. Know which partners depend on platforms you provide, and include them in your incident response plans from the start.

Sources: ANA says data on 37,800 customers leaked in hacking | Japan Airlines suffers third-party data breach exposing passenger info | Amadeus cyberattack puts passenger data at risk at four ... | JAL and ANA Customer Data Accessed Through Amadeus Breach Spanning... | Amadeus Breach Reaches JAL, ANA and Korean Airlines: Three Years of... | ANA Says Some Reservation Information May Have Been Accessed in Ama... | Notice Regarding Unauthorized Access to the Passenger Service Syste... | ANA、不正アクセス影響3.8万人　1700人はパスポート番号も＝アマデウス問題