Amadeus intruder used login credentials to access Cathay, ANA, JAL bookings
An intruder used login credentials for an Amadeus system account to access reservation records of Cathay Pacific, ANA and Japan Airlines between August 2023 and September 2026, according to the airlines. The credentials were reset and revoked, flights and payment cards were not affected, and no misuse has been seen so far. Passengers should expect phishing and fake calls quoting real booking details.
What happened
An intruder accessed passenger reservation records in the Amadeus system, a technology provider shared by Cathay Pacific, ANA and Japan Airlines, between August 2023 and September 2026. All three airlines confirmed the exposure; about 2,000 JAL customers had passport numbers and contact details stolen. According to the airlines, the account credentials used were reset and revoked.
Why it matters
Names, booking references and flight details were exposed and, for a subset of passengers, also passport numbers, emails and phone numbers, enabling scams that quote real booking details. The airlines say payment cards, passwords and flight operations were not affected. Because the failure sits with one shared provider, the damage hits several companies at once.
What to do
Warn affected customers about phishing, fraudulent calls and fake sites impersonating the airline, as JAL is doing. Demand that the reservations provider review access and credentials and prove the compromised account was revoked. Monitor for attempts to misuse the leaked data.
For the technical team
- Affected
- Amadeus, sistema de atendimento a passageiros compartilhado; registros de reservas da Cathay Pacific, ANA e Japan Airlines · Reservation records of Cathay Pacific (about 53,000 bookings), ANA (about 37,800 customers, of which about 1,700 with passport and contact details) and Japan Airlines and Japan Transocean Air (about 92,000 customers, of which about 2,000 with passport and contact details).
- Exploitation
- Unauthorized access confirmed by all three airlines; they report no misuse of the data so far. No card numbers, payment data or passwords exposed.
- Fix
- No software fix needed; the Amadeus account credentials used by the intruder were reset and revoked.
- Vector
- Amadeus passenger service system; according to the airlines, the intruder used login credentials for an Amadeus system account to access the reservation records. The account has been reset and revoked.
- More details
- Access window: August 2023 to September 2026, per the airlines. Cathay and JAL say their own systems and flights were not affected. Each airline counts differently (bookings versus customers) and populations may overlap, so there is no combined total. Amadeus informed JAL the week before the public notice. The disclosure follows a wave of incidents at Japanese firms reported by the press (a Sony Network Communications ISP with more than 2.5 million people, Burger King Japan with 11 million, Capcom with 11.7 million) and a cabinet meeting by Prime Minister Sanae Takaichi on an emergency measures package.
Timeline
Cathay Pacific and ANA disclose passenger data exposure tied to provider Amadeus, with reservation access between August 2023 and September 2026.
BleepingComputer reports the passenger data breach occurred via a third party.
Japan Airlines confirms theft of data on about 2,000 customers, including passport numbers.
Sources 3 sources
- Japan Airlines warns of data breach as country grapples with multiple cyber incidents The Record
- @BleepinComputer @BleepinComputer
- @DailyDarkWeb @DailyDarkWeb
