JAL/JTA, ANA and Cathay disclose unauthorized access to Amadeus reservation data
Amadeus reservation-data access affects about 92,000 JAL/JTA customers and 37,800 ANA customers, including 1,700 ANA customers with additional fields potentially accessed. Cathay reports around 53,000 bookings, a different unit. Do not add these figures into a unique-person total.
- Disclosed
- Oct 28, 2026
- Updated Nov 1, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Some JAL/JTA, ANA and Cathay reservation records in Amadeus; airline-specific notices define individual exposure
- aviation · third party · data exposure
- In the wild
- Not applicable
- Confirmed unauthorized access; no specific software vulnerability disclosed.
What happened
JAL/JTA’s disclosure separates about 90,000 customers with booking code, name, flight date, sector and class from about 2,000 with additional fields such as email, phone, passport number, nationality, frequent-flyer number, airline, flight/ticket number and seat. It is not 92,000 passport records. L4 reflects the scale of personal-data exposure. Amadeus has completed security measures; the JAL/JTA notice does not identify a root cause or establish ongoing access.
Cathay was informed on October 28 and received details on October 29. Its notice describes access between August 2023 and September 2026 using Amadeus system-account credentials. Most affected bookings exposed references, passenger names and flight details; a smaller subset potentially exposed contact details, travel-document or frequent-flyer numbers. There is no evidence of accessed payment information or data misuse. Amadeus reset a password and enhanced monitoring. Cathay’s systems and operations were unaffected. This expands the existing vendor event; it does not establish that every airline using Amadeus was affected.
November 1 addition: ANA’s October 30 notice identifies about 37,800 customers with reservations between August 10, 2023 and September 23, 2026. About 36,100 had names, booking references, travel dates, routes and cabin classes potentially accessed; about 1,700 also potentially had contact, passport, nationality, frequent-flyer, flight, ticket or seat details accessed. ANA excludes credit-card numbers and account passwords, reports revocation of the compromised authentication credentials and enhanced monitoring, and plans individual contact. These airline counts are separate: bookings are not people, and overlap between customer populations is unknown.
Crime-scene timeline
Oct 23, 2026
Amadeus informs JAL/JTA
Oct 28, 2026
JAL and JTA publish the affected scope
Oct 30, 2026
Cathay discloses scope; JAL/JTA confirm emails sent and inquiry desk operating
Oct 30, 2026
ANA publishes an updated scope of approximately 37,800 customers
Oct 29, 2026 (scheduled)
Original planned opening of the JAL/JTA inquiry desk
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- JAL/JTA official disclosurePrimaryOriginally disclosed October 28; October 30 revision confirms individual emails sent and the inquiry desk operating.
- Cathay official Amadeus disclosurePrimaryOctober 30: around 53,000 bookings, system-account credential access, containment and notifications.
- ANA official Amadeus scope updatePrimaryOctober 30 notice lists two customer groups, planned individual contact and revoked compromised authentication credentials.