All Nippon Airways says personal data belonging to around 37,800 customers was exposed after unauthorised access to a system operated by Amadeus, the Spain-based IT contractor that runs the airline’s passenger reservation system. Of those customers, 1,700 also had their passport numbers and nationalities leaked. No credit card information or passwords were taken, ANA said.
Key Takeaways
- About 37,800 ANA customers who booked flights between 10 August 2023 and 23 September 2026 had personal data exposed through a breach at contractor Amadeus.
- Passport numbers and nationalities were leaked for 1,700 of those customers; no payment card data or passwords were compromised.
- Keeper Security says the breach shows how one compromised vendor can expose several airline clients at once.
What the ANA data breach exposed
ANA said the affected customers booked flights operated by the airline between 10 August 2023 and 23 September 2026. The information taken included names, reservation numbers, travel dates and flight segments. For a smaller subset of 1,700 customers, passport numbers and nationalities were also exposed.
The airline was clear about what wasn’t touched: no credit card numbers, no passwords. That distinction matters, but it doesn’t make the leak harmless. Names, travel dates and passport details are still enough to build a convincing scam.
A contractor problem, not an ANA system failure
The breach didn’t originate inside ANA’s own network. It came through Amadeus, which supplies passenger service systems to airlines around the world, and that detail is drawing most of the attention from security researchers — the exposure wasn’t limited to ANA’s own defences at all.
Shane Barney, chief information security officer at Keeper Security, said the incident fits a pattern his industry has flagged all year.
“Against the backdrop of an unprecedented surge in cyber attacks across Japan this year, supply chain and third-party vendor compromises continue to serve as one of the most reliable pathways for adversaries to bypass enterprise defenses,” Barney said. “When an organisation entrusts customer records to external service providers, its security perimeter expands far beyond its internal network.”
Barney added that a second major carrier is reportedly looking into a separate leak connected to the same vendor — in his words, a sign of how far a single compromised supply chain link can reach.
Why travel data is worth stealing even without card numbers
Barney’s bigger point is about what the stolen data is actually good for. Flight details and passport numbers won’t let anyone drain a bank account directly, but they’re useful for something else: convincing someone you’re legitimate.
“Travel records represent high-value intelligence for threat actors,” he said. “Even when payment credentials remain untouched, exposed passport details, flight information and personal identifiers provide prime material for highly targeted social engineering attacks and identity fraud.”
His advice for any organisation that leans on outside vendors: stop treating third-party risk reviews as an annual formality. That means continuous vetting, monitoring remote access to contractor systems, setting clear data retention limits, and giving vendors only the access they need, for only as long as they need it.
