JAL and ANA: a passenger system of SITA, used by other alliance airlines, was attacked, leaking names and member numbers of about 920,000 and 1 million mileage members

1. 2021-02-24

   SITA of Switzerland confirmed how serious the unauthorized access to its Passenger Service System was, and told its customers and the authorities. It cut the affected system off from outside connections. [6] [8]

2. 2021-03-05

   JAL announced that data of its Mileage Bank members had leaked and emailed the affected members. [1] [2] [6]

3. 2021-03-06

   ANA announced that data of its Mileage Club members had leaked. [3] [4] [7]

At JAL, members whose data was created in SITA's system between November 24, 2011 and February 14, 2021 are affected, about 920,000 people or roughly 3% of its members. At ANA, data of about 1 million premium members leaked, also roughly 3% of its members. [1] [3]

The leaked data are three items: names in Latin letters, mileage member numbers and alliance tiers. JAL said the leak did not include names in kanji, birth dates, addresses, phone numbers, mail addresses, passwords or card numbers. ANA said it did not include passwords, card data, itineraries, booking or ticketing status, passport numbers or mail addresses. Neither had a report of misuse. [2] [4] [6] [7]

Neither JAL nor ANA uses SITA for its own passenger system. Member data is shared within the alliance so members get lounge and priority boarding services at partners, and some airlines in oneworld, which JAL belongs to, and Star Alliance, which ANA belongs to, used SITA's system, so the data seems to have leaked from there. SITA described the attack as a highly sophisticated targeted attack. [5] [6] [8]