JAL Says Amadeus Breach Exposed Booking Data on 92,000 Customers

If you have flown with Japan Airlines or its Okinawa carrier Japan Transocean Air (JTA) in the past three years, treat any unexpected email, call or website claiming to be from JAL with suspicion. The airlines say booking data on about 92,000 customers was exposed through Amadeus, the company that runs their passenger reservation system, and they expect fraudsters may try to use it.

JAL disclosed the breach in a news release on 28 October, with the same notice in Japanese and on JTA’s own homepage. It says no credit card numbers or passwords were taken.

What customers should do now

JAL’s main advice is about scams. It warns of phishing emails, fraudulent phone calls and fake websites pretending to be the JAL Group, and says it will contact affected customers directly. A message that quotes your real booking number, flight date or seat can still be fake, because those are among the details that leaked.

The safest habit is not to click links or open attachments in messages about the breach, and to go to JAL’s website or app yourself instead. For customers in the larger group, a passport number in a scammer’s hands makes an impersonation attempt more convincing, so be especially wary of anyone asking you to “confirm” passport or payment details.

JAL is opening an inquiry desk from Thursday 29 October, from 10:00 to 17:00 Japan time on weekdays, excluding public holidays. The numbers are 0120-25-6050 or 03-4332-7280 within Japan, and +81-3-4332-7280 from overseas. Those hours are 01:00 to 08:00 in the UK.

What JAL says leaked

According to JAL, Amadeus IT Group, which provides the passenger service system used by JAL and JTA, told both airlines on 23 October that there had been unauthorised access. Traces of that access run from 10 August 2023 to 23 September 2026, JAL says.

For about 90,000 customers, the exposed data is the passenger name record (PNR), or booking reference, plus name, flight date, route and class of service. For about 2,000 others, the exposed fields also include email address, phone number, passport number, nationality, frequent flyer number, airline, flight number, ticket number and seat number. JAL’s list ends with “etc.”, so it may not be complete.

The airline says there has been “no compromise of credit card numbers or any passwords”. It says Amadeus “has already completed the necessary security measures”, that there is “currently no evidence to suggest that any customer information has been misused”, and that flights are not affected. JAL has not said how the attacker got in, and Amadeus had not posted a statement on its newsroom when TSN checked.

Korean airlines reported the same provider last week

JAL is not the first airline to report trouble at Amadeus this month. Korean Air and Asiana Airlines said on 23 October that reservation data had leaked through the provider, Yonhap reported. According to The Korea Times, the Korean carriers said the breach involved unauthorised access using login credentials assigned to an account in Amadeus’s system, over the same August 2023 to September 2026 window. Korean Air said booking reference numbers were exposed, and Asiana said payment data was not affected.

Neither the airlines nor Amadeus have said whether the Japanese and Korean cases are one intrusion. In Korea, Daishin Securities has also been warning customers about scams after a separate hack.

One supplier, three years of bookings

The most telling detail in JAL’s release is the dates. Access traces stretch back to August 2023, and the airlines only heard on 23 October 2026, more than three years later. JAL’s own systems are not named as breached; the exposure sits with a supplier that holds the booking records for it. That is how modern airline booking works, and it means an airline can do everything right on its own network and still have to write to tens of thousands of customers.

It also explains why the advice is all about phishing. Booking references, names and flight dates are not much use on their own, but they make a fake “your booking has a problem” email look real. The roughly 2,000 people whose passport numbers and contact details leaked are in a different position, and JAL’s promise to contact them individually matters more for them than for the wider group.

If the Korean carriers’ account is right and a single stolen login was enough, the question for Amadeus is how one account could reach records across several airlines for so long without being noticed. That has not been answered.

A run of Japanese customer-data leaks

The JAL disclosure comes a day after So-net said hackers took member data on 2.59 million records, and it adds to the companies in TSN’s round-up of Japan’s data-breach wave, which includes the travel site skyticket. Transport has been hit before: JR East and Viewcard said about 6.09 million accounts may be exposed after an attack on a data-centre operator.

For JAL customers, the next step is the airline’s individual notices. Until one arrives through a channel you trust, the best assumption is that any message mentioning your booking could be a fake.

Sources

• Japan Airlines, news release on unauthorised access to the passenger service system provided by Amadeus, 28 October 2026
• Japan Airlines, Japanese-language release on the same incident, 28 October 2026
• Japan Transocean Air, homepage notice on unauthorised access to the Amadeus passenger service system, 28 October 2026 (Japanese)
• Yonhap, Korean Air reports personal data leak at reservation system operator, 23 October 2026 (Korean)
• The Korea Times, “Korean Air breach exposes blind spot in airline cybersecurity”, 25 October 2026

Related stories

• So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
• Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
• JR East and Viewcard Say About 6.09 Million Accounts May Be Exposed After the IDC Frontier Attack
• Daishin Says Hack Exposed 38,490 Customers as Korea Probes Bithumb