For: people who booked a Japan Airlines (JAL) or Japan Transocean Air (JTA) flight between August 10, 2023 and September 23, 2026. People who booked ANA flights should also watch for updates, since the number and items are not yet published. This article is based on the airlines' official notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Cause and route of the intrusion
- ANA's number of people and items
- Whether other airlines are affected
- When individual notices are sent
- Whether any misuse occurs (going forward)
JAL and JTA say they will contact affected customers individually (no timing given). ANA says it is confirming the scope with the vendor and will contact affected customers. On October 30 we checked the JAL and JTA notice (dated October 28) and the ANA notice (dated October 29) and found no follow-up announcement from either.
What travellers should do today
Work out whether you could be affected
In the JAL and JTA notice, traces show that booking records were viewed from outside between August 10, 2023 and September 23, 2026, covering some bookings on JAL and JTA flights. If you booked either airline in that period, assume you may be affected.
ANA says it was told there are traces of some customers' personal information having been viewed and has not published the number or items. If you booked ANA, wait for its contact and take the same steps below.
Check anything claiming to be from an airline without using its links or numbers
JAL and JTA warn about suspicious emails, calls and links to fake sites posing as the JAL Group. They say that, as of the notice, no misuse has been confirmed.
Booking number, name, boarding date and route are all material for a convincing fake message. If you get a message about "confirming check-in", "a flight change or cancellation", "an apology refund" or "expiring miles", do not use its links or phone numbers. Check in the official app or site you open yourself, or through the dedicated contact line in the notice. The same goes for a message that says it is the individual notice.
If you may be among the roughly 2,000 (email, phone, passport number, mileage number and more)
For this group, in addition to booking number and name, the company says email address, phone number, passport number, nationality, mileage number, airline, flight number, ticket number, seat number and more were viewed from outside. Until the individual notice arrives, you cannot tell whether you are in this group.
- Passport number: do not reply to anyone asking for the number or for a photo of the passport. Decide about replacing it only after you have read the individual notice and the guidance of the passport-issuing authority
- Phone number and email address: if a text or call claims to be an airline, an airport or a travel agency, call back through a number you look up yourself
Protect your mileage account
A mileage number is not the account password. The notice also says no passwords of any kind leaked. But a number and a name together can be material for messages that pose as an identity check (a general point; no one has announced that this happened here).
These steps are a sensible precaution (this site's recommendation).
- Change the mileage account password to a long one that you use nowhere else. Turn on two-step verification if it is offered
- Review the history of reward redemptions, transfers to partners and profile changes (address, email) for anything you do not recognise
- Check that you have not reused the password elsewhere (how to check if your password was leaked)
Use only the contact line printed in the notice
JAL and JTA have set up a dedicated contact line: from within Japan 0120-25-6050 or 03-4332-7280, from abroad +81-3-4332-7280, open since October 29, 2026, 10:00 to 17:00 Japan time (closed on weekends and public holidays). ANA's October 29 notice does not list a contact line.
1. Email / text / call claiming to be an airline
Booking number, name and flight are correct → do not decide here
↓
2. Do not use its links or numbers: open the official app or site yourself
↓
3a. Not shown there
Asks for a password, card or passport number or photo → do not respond
3b. The same notice is there
Follow the official instructions
What happened (according to the airlines)
The following is based on the JAL and JTA notice of October 28, 2026 and the ANA notice of October 29, 2026. We have not added the JAL/JTA figure to ANA's, whose number is not published.
Aug 10, 2023 to Sep 23, 2026
The period in which, according to JAL and JTA, traces show booking records were viewed from outsideOct 23, 2026
JAL and JTA were told by the vendor of their passenger service system that unauthorized access left traces of some booking information being viewedOct 28
JAL and JTA announced it: about 92,000 people, no effect on flights, no credit card numbers or passwords leakedOct 29
ANA announced unauthorized access to the same vendor's passenger service system, with no number or items. JAL and JTA's dedicated contact line opened
- Period
- August 10, 2023 to September 23, 2026 (the period with traces of booking records being viewed from outside)
- About 90,000 people
- Booking number, name, boarding date, route, cabin class
- About 2,000 people
- In addition, traces of viewing: email address, phone number, passport number, nationality, mileage number, airline, flight number, ticket number, seat number and more
- Not included
- Credit card numbers and passwords of any kind (per the airlines). They also say flights were not affected
- Vendor's response
- The vendor has already completed the necessary security measures, according to JAL and JTA. No misuse of the information has been confirmed so far
- Next
- The airlines will contact affected customers individually, including warnings about suspicious emails, calls and fake sites. A dedicated contact line has been set up
What is known and what is not
Status as of October 30, 2026. We will update this table as more is published.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access at the vendor | JAL and JTA were told on Oct 23. ANA announced it on Oct 29 | Announced (reported by the vendor) |
| Booking number, name, boarding date, route, cabin class (JAL, JTA) | About 90,000 people | Traces of viewing (company) |
| Email, phone, passport number, nationality, mileage number, ticket number, seat number and more (JAL, JTA) | About 2,000 people (in addition to the above) | Traces of viewing (company) |
| JAL and JTA total | About 92,000 people | Traces of viewing (company) |
| Credit card numbers and passwords (JAL, JTA) | No leak | Not included (company) |
| Effect on flights | None | None (company) |
| Misuse | No misuse confirmed so far | Not confirmed (company) |
| ANA's number and items | Says some personal information was viewed; number and items not published | Not stated |
| Cause and route of the intrusion | Not published | Under investigation |
| Effect on other airlines | Not stated | Not stated |
| When individual notices go out | JAL and JTA: going forward; ANA: after confirming the scope. No dates | Not stated |
Note: traces of viewing are not the same as a leak
JAL and JTA say there are traces that the data was viewed from outside; they do not say it was taken. This article uses their wording and does not say "leaked". Even so, information with traces of viewing is safest treated as if it was seen (this site's recommendation).
What booking data and a passport number could be used for
The following is what can generally happen with this combination of items. The airlines have not announced that any of it has happened in this incident.
- Booking number + name + date, route and flight: a convincing fake message posing as an airline about "check-in" or "changing or cancelling a flight". A correct booking detail is not proof that a message is genuine
- Email address + phone number: where fake emails, texts and calls can be sent
- Passport number + name + nationality: material for messages posing as an identity check. A number alone does not let anyone travel or sign contracts, but watch for messages that try to draw out photo documents or more details
- Mileage number + name: material for messages posing as an account check or a reward change
Most of this can be prevented by not using the links or numbers in a message and checking in the official app or site you open yourself.
What operators should review
The cause has not been disclosed, so this section covers only what can be said from the published information.
- What booking data sits with a vendor, and for how long: the period involved here is about three years. Decide which items the vendor holds and for how long, and keep sensitive items such as passport numbers only while they are needed
- Detection that depends on the vendor's report: JAL and JTA learned of it through the vendor's report. Check whether the time and procedure from detection to report are agreed with the vendor
- One vendor, several airlines: JAL, JTA and ANA have all announced the same vendor matter. Treat it as a basic premise of supply-chain management that a breach at one vendor can reach several companies
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause or at ANA's number and items, which have not been announced.
- Japan Airlines / Japan Transocean Air, "Unauthorized access to the passenger service system provided by [the passenger service system vendor]" (Japanese, October 28, 2026, checked October 30) — jal.co.jp
- All Nippon Airways, "Unauthorized access to the passenger service system provided by [the passenger service system vendor]" (Japanese, October 29, 2026, checked October 30) — anahd.co.jp
Update history
2026-10-30: First version, based on the JAL and JTA notice of October 28 and the ANA notice of October 29 (checked October 30; no follow-up found). We will update when ANA's number and items, the cause, or the timing of individual notices are announced.
Read next
- The same travel-booking pattern: The Booking.com booking data breach / Rakuten Travel unauthorized access
- Scam messages: What is phishing?
- Protecting your accounts: Choosing multi-factor authentication / Choosing a password manager / How to check if your password was leaked
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)