{
  "id": "jal-amadeus-reservations",
  "url": "https://ohshit.app/incidents/jal-amadeus-reservations/",
  "title": "JAL/JTA, ANA and Cathay disclose unauthorized access to Amadeus reservation data",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-28",
  "date_is_approximate": false,
  "updated": "2026-11-01",
  "tags": [
    "aviation",
    "third party",
    "data exposure"
  ],
  "ecosystems": [],
  "summary": "Amadeus reservation-data access affects about 92,000 JAL/JTA customers and 37,800 ANA customers, including 1,700 ANA customers with additional fields potentially accessed. Cathay reports around 53,000 bookings, a different unit. Do not add these figures into a unique-person total.",
  "splash": "Some JAL/JTA, ANA and Cathay reservation records in Amadeus; airline-specific notices define individual exposure",
  "wipe": "Watch for impersonation; use verified airline contacts and individual notices to assess your exposure",
  "in_the_wild": "n/a",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check individual notices through verified channels",
      "hint": "JAL/JTA say affected customers have been emailed. Open the official notice directly; the stated access-trace period is August 10, 2023–September 23, 2026, not a rule that every flight in that period is affected."
    },
    {
      "title": "Treat reservation-themed contacts cautiously",
      "hint": "Verify unexpected emails, calls and websites through known JAL/JTA channels, especially if they quote your booking details. The notice says no credit card numbers or passwords were compromised."
    },
    {
      "title": "Use the JAL/JTA dedicated inquiry desk",
      "hint": "From October 29: Japan 0120-25-6050 or 03-4332-7280; overseas +81-3-4332-7280. Hours are 10:00–17:00 JST on weekdays excluding Japanese national holidays."
    },
    {
      "title": "Check Cathay notices separately",
      "hint": "Read Cathay’s official October 30 notice through its website; individual notifications will follow once details are established. Use known Cathay contacts to verify unexpected requests quoting booking details."
    },
    {
      "title": "Check ANA’s individual notification and inquiry channels",
      "hint": "Read ANA’s October 30 notice directly and use its linked customer, reservation or Mileage Club contacts. ANA plans to contact affected customers; the reservation period alone does not establish individual exposure. Verify messages quoting travel details through those known channels."
    }
  ],
  "sources": [
    {
      "name": "JAL/JTA official disclosure",
      "url": "https://www.jal.co.jp/ja-jp/news/general/2026/other/261028.html?inbound=ar",
      "says": "Originally disclosed October 28; October 30 revision confirms individual emails sent and the inquiry desk operating.",
      "primary": true
    },
    {
      "name": "Cathay official Amadeus disclosure",
      "url": "https://www.cathaypacific.com/cx/es_ES/latest-news/security-and-operational-changes/personal-data-security.html",
      "says": "October 30: around 53,000 bookings, system-account credential access, containment and notifications.",
      "primary": true
    },
    {
      "name": "ANA official Amadeus scope update",
      "url": "https://www.ana.co.jp/en/jp/special-notice/001613.html?p1=international&p2=en&p3=global",
      "says": "October 30 notice lists two customer groups, planned individual contact and revoked compromised authentication credentials.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Confirmed unauthorized access; no specific software vulnerability disclosed.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 23, 2026",
      "title": "Amadeus informs JAL/JTA"
    },
    {
      "date": "Oct 28, 2026",
      "title": "JAL and JTA publish the affected scope"
    },
    {
      "date": "Oct 30, 2026",
      "title": "Cathay discloses scope; JAL/JTA confirm emails sent and inquiry desk operating"
    },
    {
      "date": "Oct 30, 2026",
      "title": "ANA publishes an updated scope of approximately 37,800 customers"
    },
    {
      "date": "Oct 29, 2026 (scheduled)",
      "title": "Original planned opening of the JAL/JTA inquiry desk"
    }
  ],
  "body_markdown": "JAL/JTA’s disclosure separates about 90,000 customers with booking code, name, flight date, sector and class from about 2,000 with additional fields such as email, phone, passport number, nationality, frequent-flyer number, airline, flight/ticket number and seat. It is not 92,000 passport records. L4 reflects the scale of personal-data exposure. Amadeus has completed security measures; the JAL/JTA notice does not identify a root cause or establish ongoing access.\n\nCathay was informed on October 28 and received details on October 29. Its notice describes access between August 2023 and September 2026 using Amadeus system-account credentials. Most affected bookings exposed references, passenger names and flight details; a smaller subset potentially exposed contact details, travel-document or frequent-flyer numbers. There is no evidence of accessed payment information or data misuse. Amadeus reset a password and enhanced monitoring. Cathay’s systems and operations were unaffected. This expands the existing vendor event; it does not establish that every airline using Amadeus was affected.\n\n**November 1 addition:** ANA’s October 30 notice identifies about 37,800 customers with reservations between August 10, 2023 and September 23, 2026. About 36,100 had names, booking references, travel dates, routes and cabin classes potentially accessed; about 1,700 also potentially had contact, passport, nationality, frequent-flyer, flight, ticket or seat details accessed. ANA excludes credit-card numbers and account passwords, reports revocation of the compromised authentication credentials and enhanced monitoring, and plans individual contact. These airline counts are separate: bookings are not people, and overlap between customer populations is unknown."
}