Japan Airlines (JAL) has disclosed a data breach involving approximately 92,000 customers after attackers gained unauthorized access to systems operated by Amadeus, a major technology provider for the global aviation industry.
The incident affected Amadeus’s Passenger Service System (PSS), which JAL Group uses to manage passenger reservations, ticketing and check-in services for Japan Airlines and Japan Transocean Air.
According to JAL’s announcement, Amadeus notified the airline on October 23, 2026, that unauthorized access to its systems had occurred between August 10, 2023, and September 23, 2026.
The breach exposed reservation information belonging to approximately 90,000 customers, including passenger names, booking reference numbers, flight dates, travel routes and travel classes.
An additional 2,000 customers had more sensitive personal information exposed. The compromised information included email addresses, phone numbers, passport numbers, nationalities, frequent flyer membership numbers, as well as flight, ticket and seat numbers.
JAL confirmed that credit card information and account passwords were not compromised during the incident. The airline also said it has not found evidence that the exposed customer information has been misused.
Amadeus has reportedly implemented security measures to address the incident. JAL added that its flight operations remain unaffected by the breach.
Amadeus is a major travel technology provider whose systems support airlines, airports, travel agencies and hotels worldwide. According to the company, its technology is used by more than 400 airlines, 210 airport operators, 34 cruise and ferry operators and approximately two million hotels.
On October 1, 2026, Amadeus published a security statement acknowledging a vulnerability in its travel booking display environment that could expose passenger information. At the time, the company said the issue had not been exploited by ransomware attackers and that no payment or other financial information had been exposed.
However, JAL’s latest disclosure indicates that the vulnerability was exploited to access customer information.
The incident may also have affected other airlines using Amadeus systems. South Korea’s Asiana Airlines and Korean Air have both confirmed security incidents associated with the same vulnerability.
All Nippon Airways (ANA), another major Japanese carrier, has also announced a customer data breach linked to Amadeus, according to local media reports.
ANA had previously suspended certain services through its website and mobile application starting October 21. However, that disruption appears to be related to the separate PHP2Shell security threat rather than the Amadeus incident.
The growing number of disclosures has raised concerns about the security of third-party technology providers that manage sensitive passenger information for multiple airlines.
BleepingComputer has contacted Amadeus for additional details about the incident, including whether other airlines, countries and markets were affected. The company had not provided further information at the time of publication.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
