Amadeus breach exposes JAL data on 92,000 people

JAL and JTA reservation data exposed in an Amadeus breach

An intruder got into a system run by Amadeus, JAL's technology vendor, and part of JAL and JTA's reservation records was exposed. JAL calls it data that "had been accessed externally." The traces start on August 10, 2023 and end on September 23, 2026.

The breach at a glance (from JAL's notice)

What	When or who
Amadeus reported to JAL	October 23, 2026
JAL and JTA went public	October 28, 2026
Vendor	Amadeus IT Group, S.A.
Traces of outside access	August 10, 2023 – September 23, 2026
People affected	About 92,000 in total

Japan has seen a run of breach disclosures this autumn. Earlier cases are listed in Japan data breach list: cases by date and cause.

Amadeus told JAL on October 23; JAL went public on the 28th

Amadeus reported the break-in to JAL on October 23, and JAL and JTA announced it five days later in a joint notice. By then, according to JAL, Amadeus had already finished the security work it needed to do. JAL has not said how the intruder got in.

Amadeus runs the airlines' passenger service system

Amadeus IT Group, S.A. is a Spanish company that supplies airlines with a passenger service system, the software an airline uses to handle reservations, ticketing and check-in. JAL and JTA run their bookings on it, and so does ANA.

The data was taken from Amadeus's system, not from a system inside JAL. That is why one vendor's problem now shows up at several airlines.

About 92,000 people affected, 2,000 with passport numbers

About 92,000 JAL and JTA customers are affected, and for about 2,000 of them the exposed data includes passport numbers and contact details. For the other 90,000 or so, five pieces of booking data were exposed: the PNR (the booking reference on an itinerary), name, flight date, route and class.

What was exposed, by group (from JAL's notice)

People	Data exposed
About 90,000	PNR, name, flight date, flight sector, class of service
About 2,000	The five above, plus email address, phone number, passport number, nationality, frequent flyer number and ticket details (airline, flight number, ticket number, seat number)

The exposed data for the larger group did not include email addresses or phone numbers. Only the smaller group of about 2,000 had contact details and passport numbers exposed together.

Credit card numbers and passwords were not exposed

In this break-in, no credit card numbers and no passwords were compromised. JAL also says it has no evidence so far that any of the exposed data has been misused. Flights are running as normal.

JAL contacts affected customers and opens an inquiry desk

JAL says it will get in touch with each affected customer. It also opened a phone desk for this case on October 29.

JAL's inquiry desk for this case (from JAL's notice)

Item	Details
From overseas	+81-3-4332-7280
From within Japan	0120-25-6050 / 03-4332-7280
Open from	Thursday, October 29, 2026
Hours	10:00 – 17:00 JST, weekdays, closed on Japanese national holidays

To find out whether your booking was affected, wait for JAL's message or call the desk. Travelers outside Japan should keep the time difference in mind, since the desk only answers during Japanese business hours.

Watch for emails and calls pretending to be JAL

JAL is warning customers about phishing emails, fake phone calls and websites that pose as the JAL Group. A message that quotes your booking code or flight date can still be fake, because those are exactly the details that were exposed.

Do not follow links in such messages. Go to JAL's own website, or call the inquiry desk number given above.

ANA and Asiana also received reports from Amadeus

All Nippon Airways (ANA) said on October 29 that Amadeus had reported unauthorized access to ANA flight reservation data. In ANA's words, there are traces that some customers' personal data was viewed. As of that notice, ANA was still working with Amadeus to pin down the scope.

ANA has not said how many people are affected or which data was involved. It plans to tell affected customers once the details are confirmed.

Update: On October 30, ANA announced that traces show reservation data of about 37,800 people was viewed. About 1,700 of them also had data such as passport numbers involved, and credit card information and passwords were not included (per ANA's announcement and press reports such as Travel Voice).

Asiana says Amadeus account login credentials were misused

South Korea's Asiana Airlines says the intruder used login credentials that had been issued to an account on Amadeus's system. Amadeus formally notified Asiana at 10:49 p.m. on October 20, 2026.

Asiana found signs that some customers' reservation numbers leaked, and it estimates the access took place between August 2023 and September 2026. That is close to the period JAL gives.

Asiana says it found no sign that its own system or database was breached. Amadeus told Asiana it has blocked the access and is watching the dark web, where stolen data is often traded.

What workplaces should review after a vendor breach

This break-in happened at Amadeus, the vendor that JAL and ANA rely on, not inside the airlines themselves. A single vendor breach has now led airlines in Japan and South Korea to warn their customers one after another.

Companies should check the systems their vendors run

Any company that keeps customer data in a vendor's system should review that vendor's security the same way it reviews its own. IPA, Japan's Information-technology Promotion Agency, ranks attacks on the supply chain and contractors second on its 2026 list of top security threats to organizations.

Keep a list of which vendor holds which customer data. When a vendor reports a breach, that list tells you right away which customers might be affected.

Staff should not open links in unexpected emails or texts

Everyone at work should avoid opening links in emails or text messages they were not expecting. Phishing means messages that pretend to come from a real company to lure people to a fake site, and a breach like this hands scammers real booking details to quote.

Japan's National Police Agency (NPA) advises bookmarking official sites or using official apps so you always reach the genuine page. Open the site from your bookmark or the app, not from a link in a message.