Japan Airlines (JAL) has revealed that a data breach at Amadeus’s Passenger Service System compromised the data of around 92,000 customers. JAL group that runs the airlines and Japan Transocean Air utilizes the system to take care of passenger reservations, ticketing as well as check-in. Amadeus informed the airline on October 23rd that unauthorized access to its systems happened between August 10, 2023 and September 23, 2026.

The malicious actor accessed reservation codes (PNRs), names, flight dates, routes as well as travel classes for around 90,000 customers. Another 2,000 customers had the above data types leaked along with respective email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, as well as seat numbers.

Amadeus is an IT organization that provides solutions for travel agencies, airlines, airports, and hotels. It is a leading tech supplier to global aviation, utilized by over 400 airlines, 210 airport operators, 34 cruise and ferry lines, as well as 2 million hotels. Amadeus published a statement on its website on October 1, 2026, declaring it had discovered a vulnerability in its travel booking display environment that could expose travelers’ data.

As per JAL, credit card numbers and passwords were not compromised in the data breach, and assured that it currently has no evidence of customer information being misused. The former said Amadeus has now implemented the necessary security measures and flight operations are unaffected.

SOURCES:-

https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/

https://tanzaniatimes.net/two-japanese-airlines-report-passengers-data-breach/

https://www.scworld.com/brief/japan-airlines-data-breach-exposes-92000-customer-records

https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html

https://mallory.ai/stories/01a18461-f576-79a3-a709-298fdc891301