Japan Airlines suffers third-party data breach exposing passenger info
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers.
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers.
JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
According to its announcement, Amadeus notified the airline on October 23, 2026, that unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026.
As a result of this lengthy breach, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers.
An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.
JAL says credit card numbers and passwords were not compromised, and assured that it currently has no evidence of customer information being misused.
The company said Amadeus has now implemented the necessary security measures and flight operations are unaffected.
Broader impact
Amadeus is an IT firm that provides solutions for travel agencies, airlines, airports, and hotels.
It is a major tech supplier to global aviation, used by over four hundred airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels.
Amadeus published a statement on its website on October 1, 2026, announcing it had discovered a vulnerability in its travel booking display environment that could expose travelers’ data.
At the time, the company said ransomware actors had not exploited the flaw and assured that no payment or other financial data had been exposed.
As JAL has confirmed now, the vulnerability appears to have been maliciously exploited.
It appears they were not the only victim of the campaign.
All Nippon Airways (ANA) has also announced a customer data breach earlier today tied to Amadeus, according to local media.
The airline has also suspended certain related services on its website and mobile app since October 21, although that action appears linked to the PHP2Shell threat rather than the Amadeus incident.
Other airlines that have confirmed impact from the Amadeus flaw are Asiana Airlines and Korean Air, both major South Korean carriers.
BleepingComputer has asked Amadeus for more information about the scope of the impact, specifically whether more airlines and other countries/markets were affected, but the company has not provided more information as of publication.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
