Japan Airlines (JAL) and its subsidiary Japan Transocean Air (JTA) say outsiders accessed customer reservation data held by Amadeus IT Group. Amadeus runs the airlines' passenger service system, which handles flight reservations, ticketing and check-in. JAL's own notice, published October 28, puts the total at about 92,000 customers. That figure combines about 90,000 people whose basic booking details were accessed and about 2,000 whose records also held passport numbers, contact details and frequent flyer numbers. Some coverage, including The Record's headline, uses "more than 90,000". That is the larger of the two groups, not a different count. JAL says no credit card numbers or passwords were taken and flight operations were not affected. Amadeus has not made its own public statement, and no one has named the attacker or said how they got in.
What Happened
JAL says Amadeus told the two airlines on October 23, 2026 that it had found "traces" showing part of their customer reservation data had been accessed from outside after someone broke into its system. Affected records cover flights with JL or NU flight numbers, according to iSec News and Traicy.
JAL says the traces of access covered August 10, 2023 to September 23, 2026. Traicy and iSec News point out that this range describes reservation data that sat in Amadeus systems during that time. It does not mean booking dates or travel dates, and it does not mean every record in that range was viewed. JAL has not said when the intrusion started or how long the attacker had access.
JAL says Amadeus "has already completed the necessary security measures" and that there is currently no evidence that customer data has been misused. The airlines will contact affected customers one by one and have set up a dedicated inquiry line, which opens October 29.
Particle reports that Amadeus sent the notice to several of its airline customers and that All Nippon Airways also received it and is checking whether its own customers were affected. Neither ANA nor Amadeus has confirmed this publicly. If it is accurate, the JAL group may be only one of several exposed carriers.
The disclosure comes during a wave of breaches at Japanese companies. The Record lists recent incidents at a Sony Network Communications-owned internet provider (more than 2.5 million people), Burger King Japan (11 million) and Capcom (11.7 million). It also reports that Prime Minister Sanae Takaichi held a cabinet meeting on Monday about the attacks.
What Was Taken
According to JAL's notice, the exposed data falls into two groups:
- About 90,000 customers: reservation code (PNR), name, flight date, flight sector and class of service.
- About 2,000 customers: all of the above, plus email address, phone number, passport number, nationality, frequent flyer number, airline name, flight number, ticket number and seat number.
JAL says credit card numbers and passwords were not compromised. Particle adds that passport photos were not accessed. JAL's notice does not mention photos either way. Particle's summary also lists "contact details" as if they applied across the whole set. JAL's breakdown says contact details were exposed only for the smaller group of about 2,000, and this brief follows the airline's account.
The 90,000 basic records are low in sensitivity on their own. A PNR plus a surname is often enough to look up or manage a booking on airline and travel-agency sites. The 2,000 enriched records hold enough identity and travel detail to make convincing impersonation and phishing much easier.
Why It Matters
A shared supplier means wider exposure. Amadeus runs reservation and departure systems for a large share of the world's airlines. A breach inside its systems is a breach at one supplier with many customers. Particle's report that ANA received the same notice suggests the impact may reach beyond the JAL group. Airlines that rely on Amadeus should assume they may be contacted and should not wait for a notice before checking their own position.
Long dwell window. The access traces reach back more than three years, to August 2023. JAL has not said whether that reflects how long the attacker was inside or only how old the reachable data was. Either way, years of stored reservation data were available to whoever got in.
Travel data enables targeted fraud. Real PNRs, routes, dates and seat numbers let scammers write rebooking, refund, compensation and "passport verification" messages that look genuine. JAL itself is warning customers about phishing emails, fraudulent phone calls and fake websites posing as the JAL Group.
Aviation is a known target. The Canadian Centre for Cyber Security's assessment of the cyber threat to aviation treats the sector as critical infrastructure facing ongoing threats. Passenger service systems and the third-party providers that run them sit at the centre of that exposure.
The Attack Technique
The cause has not been disclosed. JAL's notice describes "unauthorized access" to the Amadeus system and gives no technical detail. Amadeus has not published an advisory, and no group has claimed the attack.
Because of the timing, people will connect this to Japan's wider breach wave, but no link has been shown. For context, JPCERT/CC, Japan's national computer emergency response team, issued an alert on October 8 about a series of data leaks at Japanese organisations. Japan Cyber Watch summarises the five attack patterns JPCERT/CC has since described:
- automated scanning of each target for known vulnerabilities and poorly protected files
- abuse of internal APIs, often found by taking apart public smartphone apps
- exploitation of a Metabase SQL injection flaw
- web shells planted on Java application servers behind public web servers
- attacks run with AI penetration testing platforms such as Cairn, CyberStrikeAI and ARTEX
In its own October 21 analysis, JPCERT/CC says the attackers used AI to scan for known vulnerabilities and carried out attacks through APIs. It found attack servers holding Android APK files, the jadx and Blutter reverse-engineering tools, and Python scripts used to test for server-side request forgery (SSRF). It also found that the attackers targeted web services aimed at users outside Japan.
Japan Cyber Watch also cites Macnica's security research centre, which counts 119 similar web breaches disclosed in Japan this year, 81 of them since July. Macnica found no sign of AI-discovered zero-days and says about 80% of disclosures do not explain the cause.
Amadeus is a Spanish company with a global platform, and nothing published so far ties this incident to the activity JPCERT/CC is tracking. Until Amadeus or a regulator says more, the intrusion method should be treated as unknown.
What Organizations Should Do
- Airlines and travel firms using Amadeus: ask your account team directly whether your tenant or reservation data was in scope, what time window applies, and which data fields were reachable. Do not assume silence means you were not affected.
- Get ready for phishing aimed at your customers. Publish clear guidance on how your company will and will not contact travellers. Watch for lookalike domains, and tell call centres and social media teams to expect impersonation using real PNR details.
- Make booking lookup harder. Where possible, require more than a PNR and surname to change or view a booking. Add rate limits and anomaly detection on manage-booking and check-in endpoints.
- Review third-party data retention. The access window here covers more than three years of records. Push suppliers to purge or tokenise passport and contact data once travel is complete, and write retention limits into contracts.
- Check your API exposure against JPCERT/CC's guidance. Whether or not this incident is linked, the published defences apply widely: access control on every endpoint, API rate limits, short-lived tokens, and checks of what mobile apps reveal about backend APIs. Load JPCERT/CC's published attacker IP addresses and User-Agent strings into detection.
- Affected travellers should treat unexpected contact about their bookings with suspicion, confirm through official JAL channels or the dedicated inquiry desk, and watch for misuse of passport numbers and frequent flyer accounts.
Sources: Japan Airlines warns of data breach as country grapples with multip... | The cyber threat to aviation | Regarding Unauthorized Access to Amadeus Passenger ... | Japan Airlines Says Amadeus Breach Exposed Reservation Data for 920... | Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Inf... | JPCERT/CC Warning on Japan's Breach Wave: API Abuse, Web Shells, AI... | JAL and JTA: Some Reservation Information Accessed in Amadeus ... | Particle: JAL Says About 92,000 Customer Records Viewed in Amadeus...