Japan Airlines says Amadeus breach exposed about 92,000 passengers
Original title: Japan Airlines suffers third-party data breach exposing passenger info
About 2,000 also had passport numbers and contacts exposed; access ran from August 2023 to September 2026.
Japan Airlines said Amadeus notified it on October 23, 2026, of unauthorized access to the Passenger Service System between August 10, 2023, and September 23, 2026. About 90,000 customers had reservation codes, names, dates, routes, and travel classes exposed; roughly 2,000 also had email, phone, passport, nationality, and frequent-flyer data exposed. JAL said card numbers and passwords were not taken and it has no evidence of misuse. ANA, Asiana Airlines, and Korean Air have also reported impact from the Amadeus flaw.
Unconfirmed: Amadeus has not confirmed how many other airlines were affected, and JAL reports no evidence of misuse.
- Amadeus notified JAL of the access on October 23, 2026.
- On October 1 Amadeus said it found a booking-display flaw and saw no ransomware use.
- JAL says flights are unaffected and Amadeus has applied security measures.
- ANA’s October 21 site and app suspensions are tied to PHP2Shell, not this incident.
- Amadeus had not answered questions on whether more airlines were affected.
Impact: Passenger itineraries and some passport numbers exposed
| Product | Affected |
|---|---|
| Amadeus Passenger Service System | — |
- Vendors
- Amadeus
- Products
- Passenger Service System
- Countries
- JapanSouth Korea
From the original article
2 min read at bleepingcomputer.com
Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.