Amadeus notified four Asian carriers of unauthorized access to reservation records, putting passenger data held for Japan Airlines, Japan Transocean Air, All Nippon Airways, Korean Air and Asiana Airlines at risk. The Amadeus Cyberattack has produced sharply different disclosures: JAL reported a defined customer count, while other airlines are still investigating. The scope is not settled.
ANA said Thursday, October 29, 2026, that unauthorized access at its contractor may have exposed customers’ personal information. The airline is investigating how many people were affected and what information may have been accessed.
The incident affected reservation information handled by Amadeus, the Spanish travel technology provider whose systems support airline reservations, ticketing and check-in. Several airlines have said they found no evidence that attackers directly entered their own databases.
JAL counted 92,000 affected customers, while ANA is still assessing its exposure
JAL said hackers accessed part of the reservation data for Japan Airlines and Japan Transocean Air flights. The breach affected 92,000 customers, with names, reservation codes and flight information among the exposed details.
A smaller group faced exposure of more sensitive identifiers. About 2,000 Japan Airlines customers had passport numbers, frequent flyer numbers, email addresses and phone numbers taken, the airline said.
JAL said the breach did not affect flight operations and credit card numbers were not compromised. The airline said Amadeus informed it last week, and JAL published a notice on Wednesday. It plans to contact affected customers individually and offer assistance, including warnings about impersonation attempts.
ANA’s disclosure came on Thursday, October 29, 2026. It said one of its contractors experienced unauthorized access that could have led to customer information being leaked. The carrier has not yet determined the number affected or the specific information involved.
Amadeus also provides services to JAL. ANA said it was investigating the possible exposure through the contractor’s systems. Its review continues.
Korean Air confirmed booking references, while Asiana ruled out payment data
Korean Air received notice from Amadeus on the night of October 20 that personal information may have been leaked through the provider’s system. The airline confirmed that reservation numbers were among the exposed information, but said investigators had not established the full scope or how many customers were affected.
“We confirmed that the leaked information included airline reservation numbers,” Korean Air said. “However, specific details regarding the leaked items and the number of affected customers have yet to be confirmed”
The carrier said it had found no direct intrusion into its own systems or databases. It also said no secondary damage cases resulting from the incident had been confirmed to date. Korean Air said Amadeus’s investigation results would help determine the scale of the damage.
Asiana said booking-related customer information had been exposed through Amadeus, but payment-related information was not compromised. It uses a separate system for transactions. The airline said it found no evidence of direct intrusion into its internal databases and was strengthening security measures.
The two Korean airlines’ disclosures identify different limits to the known exposure. Korean Air confirmed reservation numbers but has not established the affected customer count; Asiana said payment information was outside the affected reservation system. The investigation remains active.
Both Korean carriers urged customers to guard against follow-up scams
Korean Air emailed customers about the breach and apologized. It cautioned them against links, attachments and messages from unclear sources, particularly communications asking them to enter personal information.
JAL said it would contact affected customers individually. Its warning covered phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group. Watch for impersonation.
Customers can follow the precautions the airlines announced:
- Do not open URLs or attachments from unclear or unidentified sources, as Korean Air advised.
- Treat messages requesting personal information with caution, and avoid entering details through suspicious links.
- Be alert to calls, emails and websites posing as the JAL Group, as JAL warned.
- Look for JAL’s individual contact to affected customers and assistance information.
Korean Air said it took security measures after receiving notice and asked Amadeus for additional protections and preventive steps. It also plans to inspect the security status of other external contractors and review practices across companies that process personal information.
The access window may stretch from August 2023 to September 2026
Investigators believe the access involved login credentials assigned to an account in Amadeus’s system. The estimated incident window runs from August 2023 to September 2026, but investigators have not established the exact timing or circumstances.
Amadeus is blocking unauthorized access and monitoring the dark web for signs that leaked information is being distributed illegally. Asiana said it was strengthening its own security measures, while Korean Air demanded stronger personal-data protections and measures to prevent a recurrence.
The incident has renewed attention on airlines’ reliance on outside technology providers. Airlines share booking, ticketing and passenger information with travel agencies, partner carriers and other service providers to manage itineraries and international routes. Building and maintaining every connection independently would require substantial investment and technical resources, industry officials said.
Shared platforms link airlines to that wider travel network, but the same connections can expose customers across different carriers when a provider suffers an intrusion. Korean Air said it would inspect contractors beyond Amadeus, and its official said the airline would devote its efforts to preventing further harm and recurrence. Contractor reviews are next.
