All Nippon Airways (ANA) says reservation data belonging to approximately 37,800 customers may have been accessed through its Amadeus passenger service system after unauthorized activity at the travel technology provider. The airline identified the number on October 30, following its initial notice on October 29 that some passenger information may have been viewed. The disclosure adds to the wider Amadeus-related passenger data exposure reported by Japan Airlines.
ANA said about 36,100 customers may have had their names, booking references, travel dates, flight routes and cabin classes accessed. Another 1,700 may have had additional details exposed, including email addresses, phone numbers, passport numbers, nationalities, frequent-flyer numbers, airline and flight details, e-ticket numbers and seat numbers. ANA said payment card details and account passwords were not involved. The airline’s initial notice confirmed unauthorized access to some reservation information, while TRAICY reported the figures disclosed on October 30.
According to TRAICY’s report, Amadeus detected unauthorized access to airline reservation data on September 24 but did not initially notify ANA. ANA said it learned on October 16 that other airlines using Amadeus had reported similar activity, asked the provider to check its own data, and received confirmation on October 20. The airline identified the potentially affected customer count on October 30.
Amadeus said the relevant authentication credentials had been invalidated and monitoring strengthened. ANA has not reported evidence that exposed information has been misused and plans to contact affected customers directly. It is warning passengers to watch for phishing emails, phone calls, websites and social media advertisements that impersonate the airline.
Amadeus said in its October security statement that it found a vulnerability affecting a travel booking display environment through which certain booking data was accessible. The company said its investigation was continuing, that it had found no evidence payment or financial data was accessed, and that it had implemented fixes and additional monitoring while working with customers and authorities.
Japan Airlines separately said in its official notice that Amadeus notified it on October 23 about unauthorized access to its Passenger Service System between August 10, 2023, and September 23, 2026. JAL reported about 90,000 customers whose names and basic reservation details may have been accessed, while another 2,000 had additional contact and passport information exposed. Cathay Pacific also said around 53,000 bookings were affected, with no evidence that financial or payment information was accessed. The airline said its own systems and operations were not affected.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
