Japan Airlines (JAL) has confirmed that a breach at one of its biggest technology suppliers exposed reservation details for about 92,000 customers, and roughly 2,000 of them also had passport numbers and contact details in the affected records. The intrusion happened at Amadeus, the Spanish travel-technology company that runs JAL's reservation, ticketing and check-in system.
What happened
JAL and its sister carrier Japan Transocean Air (JTA) say Amadeus told them on October 23, 2026, that it had found traces showing part of the airlines' customer reservation data had been viewed from outside after someone gained unauthorized access to its Passenger Service System (PSS). JAL has used that Amadeus platform since 2017 to handle bookings and check-in.
The airline published its notice on October 28 and says Amadeus has already put the needed security fixes in place. Flight operations were not affected.
The affected records belong to customers who had JAL (JL) or JTA (NU) bookings stored in the Amadeus system at some point between August 10, 2023, and September 23, 2026. Japanese outlet Aviation Wire notes that this window describes when the booking data sat in the system, not the dates customers booked or flew, and JAL hasn't said exactly when the unauthorized access took place.
Who is affected and what was exposed
JAL splits the roughly 92,000 affected customers into two groups:
- About 90,000 customers: booking reference (PNR), name, flight date, route and class of travel.
- About 2,000 customers: all of the above, plus email address, phone number, passport number, nationality, frequent flyer number, airline, flight number, ticket number and seat number.
JAL says no credit card numbers or passwords were compromised, and that it has seen no evidence so far that any of the data has been misused. The airline says it has emailed affected customers at the address they gave when booking and has set up a dedicated help line.
A wider Amadeus problem
Amadeus is one of the backbone suppliers of the travel industry, serving hundreds of airlines plus airports, hotels and cruise lines. On October 1, 2026, the company posted a statement saying it had found a vulnerability in a travel booking display environment that could expose traveller data, adding at the time that no payment or financial data was involved.
JAL's disclosure suggests that weakness was actually abused, and JAL doesn't appear to be the only victim. According to BleepingComputer, All Nippon Airways (ANA) has also announced a customer data breach tied to Amadeus, and South Korean carriers Asiana Airlines and Korean Air have confirmed they were affected as well. Amadeus had not shared further details on the full scope of the incident at the time of reporting.
The Record points out that the JAL breach lands during a run of cyber incidents hitting Japanese companies, which has pushed the government to respond in recent days.
Why it matters
Booking references and names on their own may sound harmless, but they're exactly what a scammer needs to write a convincing fake airline email, such as a "problem with your booking" message or a bogus refund or rebooking offer. For the 2,000 customers whose passport numbers, phone numbers and frequent flyer numbers were exposed, the risk of targeted phishing and identity fraud is higher.
What you should do
- Check your inbox for an official notice from JAL if you've booked JAL or JTA flights since 2023.
- Treat unexpected airline messages with suspicion. Don't click links or call numbers in emails, texts or calls about your booking; go to the airline's website or app directly instead.
- Never share card details or passwords with someone who contacts you about a flight, refund or compensation.
- Watch your frequent flyer account for odd redemptions or profile changes, and turn on extra login protection if it's offered.
- If your passport number was exposed, stay alert to identity-fraud attempts that use it, and ask your passport authority for advice if you see signs of misuse.
- If you've flown ANA, Asiana or Korean Air, check those airlines' notices too.
Sources
- BleepingComputer: Japan Airlines suffers third-party data breach exposing passenger info
- Japan Airlines: Regarding Unauthorized Access to Amadeus Passenger Service System and Our Response
- The Record: Japan Airlines warns of data breach as country grapples with multiple cyber incidents
- Aviation Wire (Japanese): JAL and JTA Amadeus unauthorized access report
- Amadeus: October 2026 statement
0 Comments