Security Checks from Real IncidentsInspect with AI
← Incident database

Amadeus passenger service system: unauthorized access to ANA, JAL, and other airlines' reservation data

amadeus-breach-2026 · Disclosed 2026-10-28

Unauthorized access occurred to the passenger service system provided by Amadeus, with evidence that reservation information was viewed externally: approximately 37,800 for ANA and 92,000 combined for JAL/JTA. The period covers August 10, 2023, to September 23, 2026, including booking references, names, travel dates, flight routing, and for some customers, passport numbers and contact information. No credit card numbers or passwords leaked, and compromised credentials have been revoked with enhanced monitoring.

Cause unresolved / undisclosed

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    A third party gained unauthorized access to Amadeus systems with evidence of reservation data viewing. Stolen authentication credentials were reportedly abused. Compromised credentials have been revoked and monitoring substantially enhanced.

    [s1][s2]unauthorized third party gained access / 窃取された正規アカウントの認証情報が悪用
  • Reported fact

    For ANA, approximately 37,800 customers who made reservations from August 10, 2023, to September 23, 2026, are affected. About 36,100 customers' data includes name, booking reference, travel date, flight routing, and cabin class; approximately 1,700 additionally include email, phone, passport number, etc.

    [s1]Approximately 37,800 customers
  • Reported fact

    For JAL/JTA, during the period from August 10, 2023, to September 23, 2026, booking references, names, travel dates, flight routing, and cabin class were viewed for approximately 90,000 people, with approximately 2,000 additionally including email addresses, phone numbers, passport numbers, etc.

    [s2]約90,000名 / 約2,000名

Timeline

  1. Amadeus reported unauthorized access to JAL. [s2]

  2. JAL announced unauthorized access. [s2]

  3. ANA announced unauthorized access. [s1] [s4]

Reported response

  • Reported fact

    Amadeus has completed necessary security measures and revoked compromised authentication credentials. No unauthorized use of the information has been confirmed at this time.

    [s1][s2]必要なセキュリティ対策を完了 / revoked
  • Reported fact

    ANA and JAL are individually contacting affected customers. Notices were sent to email addresses provided at booking.

    [s1][s2]reaching out directly / 予約時に承ったメールアドレス宛

Cause and mitigation hypotheses

Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.

Evidence relevant to prevention

Insufficient evidence

The path of credential theft and privilege controls at the time are unknown. Related rules inspect credential protection, multi-factor authentication, and access monitoring.

Editorial assessment; not a determination of liability. [s1][s2]

Unknowns and AI involvement

AI involvementUnknown

The reviewed primary sources do not establish attacker use of AI.

Specific intrusion path, credential theft method, CVEs used, and impact scope for other airlines remain unresolved. Korean Air and Asiana Airlines also reported impacts, but details are unclear.

Sources

  1. [s1] ANA · Primary source

    Regarding Unauthorized Access to Passenger Service System Provided by Amadeus ↗

    Published 2026-10-30 · Reviewed 2026-11-02

  2. [s2] JAL · Primary source

    Amadeus社が提供する旅客サービスシステムへの不正アクセスと対応について ↗

    Published 2026-10-30 · Reviewed 2026-11-02

  3. [s3] 日本経済新聞 · Secondary

    JAL、9万件超の予約情報に不正アクセス　一部はパスポート番号も ↗

    Published 2026-10-28 · Reviewed 2026-11-02

  4. [s4] ITmedia NEWS · Secondary

    ANAの予約情報に不正アクセス、JALと同じ委託先経由で　個人情報をのぞき見た痕跡も ↗

    Published 2026-10-29 · Reviewed 2026-11-02