Japan Airlines (JAL) says a breach at Amadeus’s Passenger Service System exposed data on about 92,000 of its customers. JAL Group, which operates JAL and Japan Transocean Air, uses the system for reservations, ticketing and check-in. According to JAL’s announcement as reported by BleepingComputer, Amadeus told the airline on October 23, 2026 that unauthorized access to its systems occurred between August 10, 2023 and September 23, 2026.
For roughly 90,000 customers the exposed data was reservation codes, names, flight dates, routes and travel classes. For about 2,000 more it also included email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers. JAL says credit card numbers and passwords were not compromised, that it has no evidence the information has been misused, and that flight operations are unaffected.
Amadeus supplies reservation software to airlines, airports and hotels. BleepingComputer says the company published a statement on October 1, 2026 about a vulnerability in its travel booking display environment that could expose traveler data, saying at the time that ransomware actors had not exploited it. BleepingComputer reports that All Nippon Airways (ANA) announced a customer data breach tied to Amadeus the same day, citing local media, and that Asiana Airlines and Korean Air have also confirmed impact from the Amadeus flaw. Amadeus has not told BleepingComputer how many airlines or markets are affected, so the full scope is not yet public.
Sources
- Japan Airlines suffers third-party data breach exposing passenger info, BleepingComputer
- Amadeus statement, linked from BleepingComputer (blocked our fetch; the October 1 statement is described as BleepingComputer reports it)
- JAL’s announcement, linked from BleepingComputer (the page returned access denied to our fetch, so JAL’s details are attributed to BleepingComputer)
- ANA breach report via Aviation Wire, linked from BleepingComputer (not read directly)