Japan Airlines (JAL) has disclosed a data breach involving the Amadeus passenger service system that exposed information belonging to approximately 92,000 customers. The unauthorized access lasted from August 10, 2023, through September 23, 2026, and appears to have affected other airlines that use Amadeus services.
The JAL Group, which operates Japan Airlines and Japan Transocean Air, uses Amadeus to manage passenger reservations, ticketing and check-in.
According to JAL’s announcement, Amadeus notified the airline on October 23, 2026, that unauthorized access to its systems had occurred over the more than three-year period.
The attackers accessed reservation codes, also known as PNRs, along with customer names, flight dates, routes and travel classes for approximately 90,000 customers.
For an additional 2,000 customers, the exposed information also included email addresses, phone numbers, passport numbers, nationalities, frequent-flyer numbers, airline ticket details and seat numbers.
JAL said that no credit card numbers or passwords were exposed and that there is currently no evidence that customer information has been misused.
The airline said Amadeus is implementing the necessary security measures and that flight operations will not be affected.
Potentially wider impact on airlines
Amadeus provides information technology services to travel agencies, airlines, airports and hotels. The company is a major technology supplier to the global aviation industry, with its services used by more than 400 airlines, 210 airport operators, 34 cruise ship and ferry companies, and 2 million hotels, according to Amadeus.
On October 1, 2026, Amadeus said it had discovered a vulnerability in its travel reservation display environment that could allow traveler data to be exposed.
At the time, the company said ransomware attackers were not exploiting the vulnerability and assured customers that no payment or other financial data had been compromised. JAL’s disclosure indicates that the vulnerability appears to have been maliciously exploited.
JAL may not be the only airline affected by the campaign. All Nippon Airways (ANA) also announced a customer data breach related to Amadeus earlier on October 28, 2026, according to local media.
ANA has also stopped some related services. The activity observed on the airline’s website and mobile app since October 21 appears to be related to the PHP2Shell threat rather than the Amadeus incident.
Other airlines confirmed to have been affected by the Amadeus vulnerability include Asiana Airlines and Korean Air, both major South Korean airlines.
BleepingComputer asked Amadeus for more information about the scope of the incident, including whether additional airlines or other countries and markets were affected. The company had not provided further information at the time of publication.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com