The incident occurred in the system of Amadeus, a Spanish company that operates a global airline reservation and ticketing system. It has been determined that an unauthorized party gained access to customer reservation information using login credentials for a system account. The compromised data reportedly includes reservation information from August 2023 through September of this year. A security breach in the external reservation system—shared by multiple airlines—led to this large-scale exposure of customer information.
Since the incident came to light, airlines that have disclosed the specific extent of the damage include Japan Airlines (JAL), All Nippon Airways (ANA), Cathay Pacific, and Jin Air. Japan Airlines and Japan Transocean Air stated that the information of approximately 92,000 customers was affected by the incident. Among these, evidence was found that unauthorized parties had accessed additional personal information—such as passport numbers, nationalities, email addresses, and phone numbers—for about 2,000 customers.
All Nippon Airways also reported that the information of approximately 37,800 customers was leaked, with the possibility that the passport numbers and contact information of about 1,700 of them may have been exposed. Cathay Pacific announced on the 30th of last month that unauthorized parties had accessed approximately 53,000 reservation records. The airline reported that some of the reservation information included travel certificates and frequent flyer program membership numbers.
Among domestic airlines, Jin Air announced that the personal information of 1,454 customers had been exposed. The leaked data included names, dates of birth, phone numbers, and nationalities. Korean Air and Asiana Airlines were also notified of the incident by Amadeus on the 20th of last month and informed their customers on the 23rd, but they did not disclose the exact extent of the breach.
It is also reported that the German airline Condor had some customer information leaked as a result of this incident. The aviation industry believes that, given the number of airlines that have not disclosed the extent of the damage, the actual scale of the breach is highly likely to far exceed the figures disclosed so far. However, it is reported that additional investigation is needed to confirm the exact scale of the damage, as the criteria for calculation—such as the number of reservations and the number of affected customers—vary by airline.
Amadeus stated, “To date, we have not confirmed any instances of payment information, such as credit card details, being leaked or personal information being misused for criminal purposes,” adding, “Since the incident occurred, we have reset the authentication credentials for the affected accounts and strengthened our system monitoring capabilities.”
