Japan Airlines Says Amadeus Breach Exposed Data of 92,000 Customers
Summary
Japan Airlines says unauthorized access to Amadeus’s Passenger Service System exposed reservation and travel data for about 92,000 customers between August 2023 and September 2026; JAL reports no evidence of misuse.
Key points
- JAL says Amadeus notified it on October 23, 2026, of unauthorized access spanning August 10, 2023, to September 23, 2026.
- About 90,000 customers had reservation codes, names, flight dates, routes, and travel classes exposed.
- For about 2,000 additional customers, exposed data also included contact details, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.
- JAL says credit card numbers and passwords were not compromised and that it has no evidence customer information was misused.
- JAL says Amadeus has implemented security measures; flight operations are unaffected.
- Asiana Airlines and Korean Air have also confirmed impact from the Amadeus flaw; local media reported an Amadeus-linked breach at All Nippon Airways.
Article Details
- Victim Organization
- Japan Airlines (JAL)
- Incident Type
- Third-party data breach involving unauthorized access to Amadeus’s Passenger Service System. The article says the vulnerability appears to have been maliciously exploited, but does not identify the attacker or provide technical details.
- Incident Date
- 2023-08-10
- Data Types Exposed
- Reservation codes (PNRs)
- Names
- Flight dates
- Routes
- Travel classes
- Email addresses
- Phone numbers
- Passport numbers
- Nationalities
- Frequent flyer numbers
- Flight numbers
- Ticket numbers
- Seat numbers
- Affected Records
- Approximately 92,000 customers: about 90,000 had reservation codes, names, flight dates, routes, and travel classes exposed; an additional 2,000 had those data types plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers exposed.
- Operational Impact
- JAL said flight operations were unaffected. JAL reported no evidence that customer information had been misused.
- Ransom Or Extortion
- No ransom or extortion activity was reported. Amadeus had said on October 1, 2026, that ransomware actors had not exploited the flaw; the article later says the vulnerability appears to have been maliciously exploited, without attributing the activity to ransomware.
- Claim Status
- confirmed