Japan Airlines discloses data breach affecting 92,000 customers via Amadeus reservation system

Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the personal data of approximately 92,000 customers. JAL Group, which operates the carriers JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in. According to the airline's announcement, Amadeus notified JAL on October 23, 2026, that unauthorized access to its systems had occurred between August 10, 2023, and September 23, 2026. As a result of the lengthy intrusion, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for roughly 90,000 customers. An additional 2,000 customers had those data types exposed along with email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers. JAL said credit card numbers and passwords were not compromised, and stated that it currently has no evidence of customer information being misused. The airline added that Amadeus has implemented the necessary security measures and that flight operations are unaffected. Amadeus is an IT firm that provides solutions for travel agencies, airlines, airports, and hotels, serving as a major technology supplier to global aviation. The company is used by more than four hundred airlines, 210 airport operators, 34 cruise and ferry lines, and two million hotels. On October 1, 2026, Amadeus published a statement on its website announcing it had discovered a vulnerability in its travel booking display environment that could expose travelers' data. At the time, the company said ransomware actors had not exploited the flaw and that no payment or other financial data had been exposed. JAL's disclosure now indicates the vulnerability appears to have been maliciously exploited. The Japanese carrier does not appear to be the only victim of the campaign. All Nippon Airways (ANA) has also announced a customer data breach tied to Amadeus, according to local media. ANA has suspended certain related services on its website and mobile app since October 21, although that action appears linked to the separate PHP2Shell threat rather than the Amadeus incident. Asiana Airlines and Korean Air, both major South Korean carriers, have also confirmed impact from the Amadeus flaw. BleepingComputer has asked Amadeus for more information about the scope of the impact, including whether additional airlines or markets were affected, but the company has not provided further details as of publication.