Japan Airlines has disclosed that a data breach at Amadeus's Passenger Service System exposed the personal information of about 92,000 customers, with the unauthorised access spanning more than three years.
Japan Airlines (JAL) announced that Amadeus, the IT firm that provides its passenger reservation, ticketing and check-in system, notified the airline on 23 October 2026 that a breach had occurred. The unauthorised access ran from 10 August 2023 to 23 September 2026, according to JAL's statement.
Amadeus is a major technology supplier to the global travel industry, serving over four hundred airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. The company said on 1 October that it had discovered a vulnerability in its travel booking display environment that could expose travellers' data, but at the time stated that ransomware actors had not exploited the flaw and that no payment or financial data had been exposed.
For approximately 90,000 JAL customers, the attackers accessed reservation codes, names, flight dates, routes and travel classes. An additional 2,000 customers had those data types exposed plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers. JAL said credit card numbers and passwords were not compromised and that it currently has no evidence of customer information being misused. The airline said Amadeus has now implemented necessary security measures and that flight operations are unaffected.
Other airlines have also been linked to Amadeus-related breaches or confirmed impact. All Nippon Airways (ANA) announced a customer data breach earlier on the same day tied to Amadeus, according to local media, and has suspended certain related services on its website and mobile app since 21 October, although that action appears linked to the PHP2Shell threat rather than the Amadeus incident. South Korean carriers Asiana Airlines and Korean Air have also confirmed impact from the Amadeus flaw.
Analysis
Why This Matters
- The breach exposes sensitive personal data of nearly 100,000 travellers, including passport numbers and frequent flyer details, raising risks of identity theft and fraud.
- The three-year duration of unauthorised access highlights weaknesses in detection and response at a critical global travel IT provider.
- Multiple major airlines across Japan and South Korea have already confirmed impact, suggesting the incident may extend further across the industry.
Background
Amadeus is a Spanish-headquartered IT company that provides reservation and booking systems used by hundreds of airlines, airports, hotels and travel agencies worldwide. Its Passenger Service System handles seat inventory, ticketing, check-in and departure control for many carriers. The vulnerability was first disclosed by Amadeus on 1 October 2026, when it said the flaw had not been exploited maliciously. JAL's announcement now confirms that malicious exploitation did occur.
Key Perspectives
Japan Airlines: Says Amadeus notified it on 23 October about the breach, that credit card numbers and passwords were not compromised, and that there is no evidence customer information has been misused. Flight operations are unaffected.
Amadeus: Stated on 1 October that it had discovered a vulnerability in its travel booking display environment that could expose traveller data, and said ransomware actors had not exploited the flaw and no payment or financial data had been exposed.
What to Watch
- Whether further airlines in other regions confirm customer data exposure from the same Amadeus vulnerability.
- Any reports of customer data being misused or appearing on criminal forums in the coming months.
- Potential regulatory investigations by data protection authorities in Japan, South Korea and Europe, given Amadeus's global footprint.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe breach at Amadeus’s Passenger Service System exposed data belonging to about 92,000 Japan Airlines customers.BleepingComputer: “a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers.”
- SupportedThe breach involved passenger names, flight details and some passport numbers, and the unauthorised access lasted more than three years.BleepingComputer: “unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026. As a result of this lengthy breach, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers. An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers”
- SupportedAmadeus notified JAL of the unauthorised access on 23 October 2026.BleepingComputer: “Amadeus notified the airline on October 23, 2026, that unauthorized access to its systems occurred”
- SupportedThe access ran from 10 August 2023 to 23 September 2026.BleepingComputer: “unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026.”
- SupportedAbout 90,000 customers had reservation codes, names, flight dates, routes and travel classes accessed; an additional 2,000 had those data types plus further personal and travel details exposed.BleepingComputer: “the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers. An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.”
- SupportedJAL said credit card numbers and passwords were not compromised, and it has no current evidence that customer information was misused.BleepingComputer: “JAL says credit card numbers and passwords were not compromised, and assured that it currently has no evidence of customer information being misused.”
- SupportedJAL said Amadeus implemented necessary security measures and flight operations were unaffected.BleepingComputer: “The company said Amadeus has now implemented the necessary security measures and flight operations are unaffected.”
- SupportedAmadeus disclosed on 1 October 2026 that it had found a vulnerability in its travel booking display environment that could expose traveller data; it said ransomware actors had not exploited the flaw and no payment or other financial data had been exposed at that time.BleepingComputer: “Amadeus published a statement on its website on October 1, 2026, announcing it had discovered a vulnerability in its travel booking display environment that could expose travelers’ data. At the time, the company said ransomware actors had not exploited the flaw and assured that no payment or other financial data had been exposed.”
- SupportedAmadeus serves over 400 airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels.BleepingComputer: “used by over four hundred airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels.”
- SupportedANA announced a customer data breach tied to Amadeus earlier on the same day, according to local media.BleepingComputer: “All Nippon Airways (ANA) has also announced a customer data breach earlier today tied to Amadeus, according to local media.”
- SupportedANA had suspended certain related website and mobile-app services since 21 October, though that action appeared linked to the PHP2Shell threat rather than the Amadeus incident.BleepingComputer: “The airline has also suspended certain related services on its website and mobile app since October 21, although that action appears linked to the PHP2Shell threat rather than the Amadeus incident.”
- SupportedAsiana Airlines and Korean Air confirmed impact from the Amadeus flaw.BleepingComputer: “Other airlines that have confirmed impact from the Amadeus flaw are Asiana Airlines and Korean Air”
