Japan Airlines Discloses Third-Party Data Breach Affecting 92,000 Customers

Japan Airlines (JAL) announced that a security incident at Amadeus, its third-party Passenger Service System provider, exposed the personal data of approximately 92,000 customers. According to the airline's announcement, Amadeus informed JAL on October 23, 2026, about unauthorized system access that spanned from August 10, 2023, to September 23, 2026.

Incident Details and Affected Data

• Primary Group (approx. 90,000 customers): Exposed data includes reservation codes (PNRs), passenger names, flight dates, routes, and travel classes.
• Secondary Group (approx. 2,000 customers): Exposed data includes all items from the primary group, plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, along with specific flight, ticket, and seat numbers.
• Unaudited/Safe Elements: JAL reported that credit card numbers and passwords were not compromised. The airline also stated it currently has no evidence indicating that the exposed customer information has been misused.

Amadeus Involvement and Industry Scope

Amadeus, a major IT supplier providing booking and management solutions to global aviation and travel industries, announced on October 1, 2026, that it had identified a vulnerability in its travel booking display environment. While initial disclosures suggested no financial data exposure or ransomware exploitation, JAL's confirmation indicates malicious exploitation occurred.

Reports indicate that other carriers have also been affected by issues tied to Amadeus, including All Nippon Airways (ANA), Asiana Airlines, and Korean Air. Amadeus has since implemented necessary security measures, and JAL confirmed that flight operations remain unaffected.

Practical Implications and Verification

Affected customers should remain vigilant against targeted phishing attempts or suspicious communications referencing their travel itineraries, PNRs, or frequent flyer accounts. Individuals wishing to verify official updates should consult the official Japan Airlines investor relations or newsroom portal for direct announcements and guidance.