Japan Airlines suffers third-party data breach exposing passenger info

What it is

Japan Airlines (JAL) says unauthorized access to Amadeus's Passenger Service System exposed data on about 92,000 customers. JAL Group, which includes JAL and Japan Transocean Air, uses the system for reservations, ticketing and check-in. Amadeus notified JAL on 23 October 2026. The access ran from 10 August 2023 to 23 September 2026.

What was exposed

• About 90,000 customers: reservation codes (PNRs), names, flight dates, routes and travel classes.
• About 2,000 customers: the same fields plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers.
• JAL says credit card numbers and passwords were not compromised. It reports no evidence of misuse so far.

Preconditions / Affected

Amadeus supplies over 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. On 1 October 2026 it disclosed a vulnerability in its travel booking display environment. It said then that ransomware actors had not exploited it and that no payment data was exposed. BleepingComputer concludes from JAL's notice that the flaw was exploited maliciously. The page does not describe the flaw's mechanism and gives no CVE.

Other carriers tied to the Amadeus issue:

• All Nippon Airways (ANA) announced a customer data breach on 30 October 2026, according to local media.
• Asiana Airlines and Korean Air have confirmed impact.
• ANA has also suspended some website and app services since 21 October. The page says this appears linked to the PHP2Shell threat, not to Amadeus.

What to do

The page gives no mitigations or detections. JAL says Amadeus has now applied the necessary security measures and flight operations are unaffected. For anyone who uses Amadeus or whose staff travel on these carriers, the exposed passport and contact data is the relevant risk. That is an inference, not advice from the page.

Caveats

Amadeus has not told BleepingComputer whether other airlines or markets are affected. The full scope is unknown. The ANA details come from local media, not from a primary notice.