Japan Airlines says Amadeus breach exposed data of about 92,000 customers

Japan Airlines (JAL) says a breach at Amadeus’s Passenger Service System exposed information linked to about 92,000 customers. JAL Group uses the system for reservations, ticketing and check-in for JAL and Japan Transocean Air.

Amadeus notified JAL on October 23, 2026, that unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026. JAL says reservation codes, names, flight dates, routes and travel classes were exposed for approximately 90,000 customers. For another 2,000, the exposed data also included email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers.

JAL says credit card numbers and passwords were not compromised, and that it has no current evidence of customer information being misused. It says Amadeus has implemented security measures and flight operations are unaffected.

Amadeus said on October 1, 2026, that it had found a vulnerability in its travel booking display environment, and said ransomware actors had not exploited it and no payment or other financial data was exposed. JAL’s announcement indicates the vulnerability was maliciously exploited. BleepingComputer reported that Asiana Airlines and Korean Air had also confirmed impact. It said Amadeus had not provided further information by publication time.