Amadeus Breach Exposes Data on 92,000 JAL Passengers; ANA and Cathay Hit Too

A break-in at Amadeus, the Spanish company whose software runs reservations, ticketing and check-in for hundreds of airlines, exposed booking records for about 92,000 Japan Airlines customers, the airline said Oct. 30, 2026. All Nippon Airways and Cathay Pacific disclosed the same day that their passengers were affected too, and the intruders had access for more than three years, from Aug. 10, 2023, to Sept. 23, 2026, according to JAL’s notice.

Key figures: ~92,000 JAL customers · ~37,800 ANA customers · ~53,000 Cathay bookings · access window of about 1,140 days

What JAL says was taken

Amadeus told Japan Airlines and its sister carrier Japan Transocean Air on Oct. 23 that it had found traces showing part of their customer reservation data had been accessed from outside through unauthorized access to its Passenger Service System, the platform that ties together flight reservations, ticketing and check-in.

For about 90,000 customers, the exposed data was the booking code, name, flight date, route and class of service. For about 2,000 more, it also included email address, phone number, passport number, nationality, frequent flyer number, flight number, ticket number and seat number. JAL said no credit card numbers or passwords were compromised, that Amadeus has completed the necessary security measures, and that there is currently no evidence any customer information has been misused. Flight operations were not affected.

JAL has emailed affected customers at the addresses they gave when booking and asked everyone to watch for phishing emails, fraudulent calls and fake websites pretending to be the JAL Group.

ANA and Cathay Pacific confirm the same intrusion

ANA said about 37,800 of its customers who booked between Aug. 10, 2023, and Sept. 23, 2026, were affected. About 36,100 had their name, booking reference, travel date, routing and cabin class exposed, and about 1,700 also had contact details, passport numbers and other travel details exposed. ANA said Amadeus told it the compromised login credentials have been revoked and that monitoring has been substantially stepped up.

Hong Kong’s Cathay Pacific said Amadeus notified it on Oct. 28 and gave further details on Oct. 29. About 53,000 Cathay bookings were affected. Cathay said the access came from an unauthorized party using login credentials assigned to an account on Amadeus’s system, that Amadeus reset the password and added monitoring, and that there is no evidence financial or payment data was accessed. Cathay has informed the relevant authorities and will notify affected customers individually.

Korean Air and Asiana Airlines have also reported unauthorized access involving information managed by Amadeus, but both said they found no sign their own internal databases were compromised, Travel Weekly Asia reported. Amadeus serves more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels, and it had said on Oct. 1 that it found a vulnerability in its travel booking display environment, BleepingComputer reported. Amadeus had not answered BleepingComputer’s questions about how many airlines and markets were affected as of that report.

By the numbers: how big the known exposure is

The three carriers that published counts on Oct. 30 together account for about 129,800 customers at JAL and ANA plus about 53,000 Cathay bookings. Cathay counted bookings rather than people, so the figures cannot simply be added into one total. Among the two Japanese airlines, about 3,700 customers, or roughly 2.9% of their combined 129,800, had the more sensitive passport and contact data exposed, by TBR’s calculation from the airlines’ notices. JAL’s count is about 2.4 times ANA’s.

Why a supplier breach reaches so far

The case shows how much of air travel depends on a few shared technology providers. When one supplier’s account is misused, data from many airlines can be exposed at once, and each carrier learns about it only when the supplier reports it. The long window, more than three years by the airlines’ accounts, is a reminder that credential misuse can go undetected for a long time.

Passengers who booked JAL, ANA or Cathay flights in that period should be wary of messages that cite real booking details, since names, routes and booking codes are exactly what a convincing phishing email would use. The Boston Report has tracked other large cyber incidents this week, including the $6.3 billion Binance hack and the KeyDrift hack on satellite firms.

Sources

• Japan Airlines: Unauthorized access to Amadeus Passenger Service System (Oct. 30, 2026)
• ANA: Unauthorized access to Passenger Service System provided by Amadeus (Oct. 30, 2026)
• Cathay Pacific: Personal data security incident (Oct. 30, 2026)
• BleepingComputer: Japan Airlines suffers third-party data breach (Oct. 29, 2026)

Additional sources

• Travel Weekly Asia: Amadeus cyberattack puts Asian airlines on alert (Oct. 30, 2026)
• Aviation Wire (Japanese): JAL and JTA Amadeus access report