ANA Says 37,800 Customers May Be Affected by Amadeus Breach, Including 1,700 Passport Numbers

Reservation details exposed through an airline technology supplier

All Nippon Airways said on October 30, 2026, that reservation information belonging to about 37,800 customers may have been exposed after unauthorized access to systems operated by its Spanish technology contractor, Amadeus IT Group. About 1,700 customers also had passport numbers and other personal details among the information that showed signs of access from outside the system.

ANA said Amadeus detected the unauthorized access on September 24, but the airline received a report from the contractor on October 20, 26 days later. ANA had asked Amadeus to investigate its exposure after learning on October 16 that other airlines using the supplier had been affected.

The airline identified two groups of affected customers. About 36,100 had basic reservation information exposed, including names and travel details. About 1,700 had a wider set of information involved, including contact details, passport numbers and frequent flyer numbers. Credit card information and passwords were outside the affected data, ANA said.

ANA plans to begin contacting affected customers during the first week of November. Its immediate warning to passengers concerns suspicious emails, calls, websites and social media advertisements pretending to come from the ANA Group.

The incident reaches beyond one airline. Japan Airlines and Japan Transocean Air had already announced that about 92,000 customers were potentially affected by unauthorized access involving the same supplier. Other Japanese carriers were still checking their exposure, while reservation numbers belonging to Korean Air and Asiana Airlines customers had also been reported exposed.

What information was involved?

ANA's largest affected group, about 36,100 people, had five types of information showing signs of outside access: names, reservation numbers, travel dates, flight segments and cabin classes. A flight segment is one part of a journey, such as a flight from Tokyo to Sapporo. Cabin class identifies the category of travel, such as economy or business.

The smaller group of about 1,700 customers had those same details involved, plus email addresses, telephone numbers, passport numbers, nationalities, frequent flyer numbers, airline names, flight numbers, ticket numbers and seat numbers.

Passport numbers were therefore among the affected information for roughly 4.5% of the 37,800 customers identified by ANA. The other approximately 95.5% fell into the group whose exposed information was limited to the five basic reservation fields.

ANA described evidence that reservation information had been viewed from outside the system. Whether the information was also copied out of the system or subsequently misused had not been confirmed in its announcement. The practical concern for passengers is that the affected fields can connect a person's identity with a specific journey.

Which bookings fall within the affected period?

ANA identified some customers who made reservations between August 10, 2023, and September 23, 2026, as affected. Its disclosure concerns a subset of bookings across that period of more than three years, rather than every passenger who booked during those dates.

The period was also described as covering ANA operated flights from August 10, 2023, through September 23, 2026. Most detailed descriptions of the announcement identify it as the period when reservations were made. Customers should use ANA's individual notification to determine whether their own booking is included.

The affected records contain information passengers provide or generate when arranging travel. A reservation number identifies a booking, while a ticket number identifies the issued travel document. Those details can remain in a passenger service system after the initial purchase, which helps explain why the disclosure covers reservations stretching back to 2023.

How the discovery and disclosure unfolded

ANA first publicly disclosed the incident on October 29, while it was still investigating the number of customers and the information involved. The following day, it announced the estimate of 37,800 affected customers and the two categories of exposed data.

The sequence began more than a month before those public announcements:

• September 24, 2026: Amadeus detected unauthorized access to airline reservation information. ANA said it did not receive a report at that point.
• October 16: ANA learned about incidents affecting other airlines using Amadeus and asked the supplier to check ANA flight reservation information.
• October 20: ANA received a report from Amadeus and reported the matter to Japan's Personal Information Protection Commission and other relevant bodies.
• October 29: ANA disclosed signs that some customer reservation information had been accessed externally.
• October 30: ANA identified about 37,800 potentially affected customers and detailed the information involved.
• First week of November: ANA plans to begin contacting affected customers in stages.

The dates show that ANA's inquiry preceded the contractor's report to the airline. Amadeus detected the incident on September 24, and ANA requested its own exposure check 22 days later. The supplier then reported to ANA four days after that request.

ANA and Amadeus continued checking customer information after October 20. Japan's Personal Information Protection Commission, which received ANA's report, is the authority responsible for overseeing the protection of personal information.

What Amadeus has done

Amadeus provides the passenger service system involved in the incident. Airlines use such systems to manage functions including reservations and ticket issuance, placing customer information with a specialist technology supplier as part of ordinary travel operations.

ANA said it confirmed with Amadeus that credentials connected to the unauthorized access had been disabled and monitoring had been strengthened. Credentials are the digital identifiers or access details that allow a person or a system to enter a service. Disabling them removes the ability to continue using those particular access details.

Amadeus also said there was no evidence of ransomware damage, alteration or deletion of data, and no interruption to the services it provides. Ransomware is malicious software used to lock information or systems and demand payment. Here, the response described by ANA centers on unauthorized access to customer records and the removal of associated access credentials.

The measures address access and monitoring at the supplier. ANA's parallel task is to identify the people whose information was involved and tell them which details were affected.

Other airlines face the same supplier incident

Japan Airlines and Japan Transocean Air announced on October 28 that reservation information belonging to about 92,000 customers showed signs of outside access through Amadeus. About 2,000 of those customers also had passport numbers and other details potentially exposed. The two airlines received their report from Amadeus on October 23.

The 92,000 customers identified by JAL and JTA amount to about 2.4 times ANA's figure of 37,800. Passport numbers and other additional details were involved for approximately 2.2% of the JAL and JTA group, compared with about 4.5% of ANA's group.

Air Do, Solaseed Air and StarFlyer, which use Amadeus systems through ANA, said they were informed by ANA on October 29 that personal information showed signs of outside access. They were working with ANA to determine the scope of the impact. Korean Air and Asiana Airlines customers also had reservation numbers exposed, extending the incident's reach beyond Japan.

JAL and JTA said they had confirmed no misuse of the affected information and no impact on flight operations. Across the airlines, the shared supplier creates a common point of exposure, while each carrier must identify its own affected customers and handle notifications.

Why ANA is warning about impersonation

ANA has urged customers to watch for messages and calls falsely claiming to represent the airline group. Reservation information can make an attempted scam more convincing because a caller or email sender may know a real travel date, destination or flight number.

A fraudulent message could, for example, claim that a genuine booking needs an urgent payment or that a refund requires the passenger to enter financial details. Phishing is the practice of impersonating a trusted organization to persuade someone to disclose information or visit a deceptive website.

Passengers receiving an unexpected message about a booking can check it through the ANA website or app they normally use, rather than following a link or telephone number in the message. Requests for passwords, verification codes, card information or passport images deserve particular caution when they arrive through an unsolicited contact.

ANA's planned individual notices will give affected customers a more useful basis for action than the broad reservation period alone. For someone in the group of about 1,700, the concern includes contact and identity details as well as the itinerary. For the larger group, the exposed information still links a name to a journey.

Other disclosures widen Japan's data security concerns

Japan's Foreign Ministry also said on October 30 that unauthorized access may have exposed about 3,600 records containing personal information, including names and email addresses. About 900 records belonged to people outside the ministry. The affected environment was a network connected to external systems; the ministry said it had confirmed no unauthorized access in a separate closed network handling highly confidential information.

Muji operator Ryohin Keikaku disclosed that up to 27.26 million customer records may have been exposed through unauthorized access to its official app. Potentially affected fields included email addresses, dates of birth and gender, including information associated with people who had withdrawn from the app. Names and credit card information were outside the affected data.

Muji said it had confirmed no misuse, would contact affected customers individually and was continuing to operate its app and online store normally. It also warned customers against clicking links in suspicious emails. The airline, ministry and retail disclosures involve different information and services, but each leaves affected people needing precise notices about which personal details were exposed.

Key Points

• ANA identified about 37,800 customers whose reservation information may have been exposed through unauthorized access at Amadeus.
• About 36,100 customers had basic reservation details involved; about 1,700 also had passport numbers, contact details and other information involved.
• ANA said credit card information and passwords were outside the affected data.
• Amadeus detected the incident on September 24, 2026. ANA received its report on October 20 and detailed the affected customers on October 30.
• Amadeus disabled associated credentials and strengthened monitoring. It reported no service interruption.
• ANA plans to begin individual notifications in the first week of November and is warning about impersonation attempts.
• JAL and JTA separately identified about 92,000 affected customers, while other carriers were checking their exposure.