ANA: reservation data for about 37,800 customers may have been viewed at Amadeus, passport numbers for about 1,700 included
All Nippon Airways said in an updated notice on October 30, 2026 that unauthorised access at Amadeus may have exposed reservation data for about 37,800 customers — booking details for about 36,100, and contact details, passport numbers and frequent flyer numbers for about 1,700 more; card numbers and passwords were not included.
What happened
All Nippon Airways (ANA) published an updated customer notice on October 30, 2026 putting a number on its part of the breach at Amadeus, the travel-technology company that runs its passenger service system: reservation data for approximately 37,800 ANA customers may have been accessed. ANA’s first notice, on October 29, had said only that some passenger information may have been viewed, with no count or data types — this desk held that version until the airline published the figures. This is the same Amadeus incident behind the Japan Airlines report we published on October 28 and the Cathay Pacific report we published on October 30: an unauthorised party used credentials assigned to an Amadeus system account, and the access traces run across bookings made from August 10, 2023 to September 23, 2026. This report is labelled POTENTIAL EXPOSURE because ANA’s wording throughout is that the data “may have been” accessed or viewed.
ANA said the compromised authentication credentials have been revoked and security monitoring strengthened. It reported no evidence that the exposed information has been misused, and it is contacting affected customers individually.
Who is affected
Approximately 37,800 customers who made ANA reservations between August 10, 2023 and September 23, 2026, in two groups. For about 36,100 of them, the information that may have been accessed is basic booking information: passenger names, booking references, travel dates, flight routes and cabin classes. For about 1,700 more, additional personal information may also have been exposed: email addresses, telephone numbers, passport numbers, nationality, frequent flyer numbers, flight numbers, electronic ticket numbers and seat information.
ANA confirmed what was not included: no credit card numbers and no account passwords were part of the affected data, and the airline’s own systems were not the point of entry — the access happened inside Amadeus’s systems, the same pattern as the other airlines in this incident.
How serious
For most of the 37,800, the concrete risk is a booking in someone else’s hands: a name plus a booking reference is the pair airline systems use to look up and manage a reservation, so it can support attempts to view or interfere with a trip, and it makes a fake “your flight has changed” message highly convincing when it quotes a real route and date. For the roughly 1,700 customers whose passport numbers were included, the exposure is more serious: a passport number is a government identity-document number that changes rarely, and paired with a name, date of travel and contact details it is useful material for identity fraud and for targeted phishing that borrows the authority of a real booking. No payment card details or passwords were involved, so this data alone does not empty a bank account or open the customer’s ANA account — the danger is impersonation built on accurate travel details.
What to do now
ANA is contacting affected customers individually and has specifically warned passengers about suspicious communications claiming to represent the airline — emails, telephone calls, websites and social-media advertisements. If a message about an ANA booking asks you to pay a fee, re-enter payment details or click through to “confirm” a change, do not use its links or numbers: open the ANA website or app directly, or use the contact details on your original booking confirmation.
If your passport number was in the smaller group, watch for identity-check attempts and correspondence about your travel documents that you did not start, and follow any document-specific instructions in ANA’s direct notification. Everyone in the wider group should check upcoming reservations for changes they did not make, and treat any unsolicited message quoting a real booking reference with suspicion rather than relief — in this incident, a correct booking reference proves only that the sender has seen the leaked data.
We first flagged this incident on October 28, 2026 — see our Japan Airlines Amadeus report and our Cathay Pacific Amadeus report for the same breach at the other airlines.
Sources: Travel And Tour World (ANA updated notice report), October 30, 2026 · Cargo Facts (Bloomberg), October 30, 2026