Japan Airlines (JAL) has confirmed that a data breach within Amadeus’ Passenger Service System exposed the personal information of around 92,000 customers. The JAL Group uses the system to handle passenger reservations, ticketing and check-in.
Amadeus’ lengthy data breach
According to the airline’s announcement, Amadeus IT Group notified Japan Airlines and Japan Transocean Air on Oct. 23 that unauthorised access to its systems had occurred between Aug. 10, 2023 and Sept. 23, 2026. During this lengthy period, the threat actor accessed reservation codes, names, flight dates, routes and travel classes for approximately 90,000 JAL customers.
A further 2,000 customers had additional data types exposed, including email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, flight numbers, ticket numbers and seat assignments.
JAL said card numbers and passwords were not compromised, and the airline assured customers that it currently has no evidence that any of the breached information had been misused. It added that Amadeus has now implemented the necessary security measures and flight operations remain unaffected.
In the same announcement, JAL said:
“We have contacted the affected customers regarding this matter via the email addresses provided at the time of booking. We kindly ask you to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group.”
Broader impact of the breach
On Oct. 1, 2026, Amadeus announced it had identified a vulnerability in its travel booking display environment that could expose traveller data. At the time, the company said ransomware actors had not exploited the vulnerability and assured that no payment or financial data had been exposed. However, JAL has indicated that the breach appears to have been maliciously exploited.
All Nippon Airways (ANA) has also reported a customer data breach linked to Amadeus. The airline has suspended certain related services on its website and mobile app since Oct. 21, though that action appears to be linked to a different cyberattack.
Other carriers confirming that they had been affected by the data breach include Asiana Airlines and Korean Air.
What do you think about the Amadeus data breach and its impact on airlines and customers? Let us know in the comments.
