Japan Airlines (JAL) has disclosed a data breach affecting approximately 92,000 passengers after hackers gained unauthorized access to systems operated by its technology provider, Amadeus. The incident exposed reservation details and, in some cases, sensitive personal information, including passport numbers and contact details.
The breach involved Amadeus’s Passenger Service System (PSS), which Japan Airlines and its subsidiary Japan Transocean Air use to manage flight reservations, ticketing, and passenger check-in. The airline learned about the incident on October 23, 2026, after Amadeus discovered evidence of unauthorized access to customer records.
According to JAL’s announcement, the suspicious activity covered a period from August 10, 2023, to September 23, 2026. The extended timeframe indicates that passenger information may have been accessible to unauthorized parties for more than three years.
The majority of affected passengers, approximately 90,000 individuals, had their reservation codes, names, flight dates, routes, and travel classes exposed. However, another 2,000 customers were affected by a more extensive disclosure involving email addresses, telephone numbers, passport numbers, nationalities, frequent flyer numbers, flight numbers, ticket numbers, and seat assignments.
Japan Airlines confirmed that credit card information and passwords were not compromised. The airline also stated that its flight operations remain unaffected and that Amadeus has completed the necessary security measures to address the incident.
The disclosure follows an earlier security announcement from Amadeus on October 1, when the company reported discovering a vulnerability in its travel booking display environment that could expose passenger information. At that time, Amadeus said it had found no evidence of ransomware exploitation or exposure of financial data.
Other airlines have also reported incidents involving the Amadeus platform. South Korean carriers Korean Air and Asiana Airlines have confirmed exposure related to the vulnerability, while Japan’s All Nippon Airways has reportedly disclosed a similar customer data breach.
The full scope of the incident across Amadeus customers remains unclear, and the company has not publicly established how many airlines or passengers were affected worldwide.
Japan Airlines said it has found no evidence that the exposed information has been misused. Nevertheless, the airline is contacting affected passengers individually and warning them about phishing emails, fraudulent telephone calls, and websites impersonating JAL.
A dedicated customer inquiry service became available on October 29, allowing passengers to seek additional information and assistance concerning the breach.