On 28 October 2026, Japan Airlines disclosed that approximately 92,000 customers of JAL Group, covering Japan Airlines and Japan Transocean Air, had reservation data exposed.
The breach was not at the airline. It was at Amadeus IT Group, which runs JAL's flight reservation, ticketing and check-in systems. Amadeus notified JAL on 23 October 2026 that it had found traces indicating "a portion of customer reservation data" had been accessed externally.
The dates are the story. Unauthorised access ran from 10 August 2023 to 23 September 2026. That is roughly 37 months, more than three years, before anyone detected it.
Passport numbers were not taken for everyone. Around 90,000 people had reservation codes, names and itinerary details exposed. A smaller group of about 2,000 additionally had passport numbers, nationality, email addresses, phone numbers, frequent flyer numbers, flight numbers, ticket numbers and seat numbers taken.
The two groups face materially different risks and should take different steps.
And JAL is not alone. The same Amadeus flaw has affected All Nippon Airways, Cathay Pacific, Korean Air and Asiana Airlines, with Malaysia Airlines warning customers about fraudulent messages.
What happened
Timeline
When | What |
|---|---|
10 August 2023 | Unauthorised access to the Amadeus Passenger Service System begins |
1 October 2026 | Amadeus publicly discloses a vulnerability in its travel booking display environment, stating ransomware actors had not exploited it and no payment data was exposed |
23 September 2026 | Unauthorised access ends |
23 October 2026 | Amadeus notifies Japan Airlines and Japan Transocean Air |
28 October 2026 | JAL Group publishes its notice |
Note the sequence in that table. Amadeus disclosed the vulnerability on 1 October and said at the time that it had not been exploited by ransomware actors. JAL's confirmation indicates the flaw was maliciously exploited, which is a material change from the original position.
What was taken
For approximately 90,000 customers:
Reservation code (PNR)
Name
Date of travel
Journey route
Class of travel
For approximately 2,000 customers, additionally:
Email address and phone number
Passport number and nationality
Frequent flyer number
Flight number, ticket number and seat number
Not taken: credit card numbers and passwords. JAL states there is no evidence of misuse so far, and flight operations were never affected.
The scale across the industry
Japan Airlines is one carrier among several. Reported figures:
Airline | Affected records |
|---|---|
Japan Airlines | 92,000 |
Cathay Pacific | 53,000 |
All Nippon Airways | 37,800 |
Korean Air | Confirmed, scale not determined |
Asiana Airlines | Confirmed, scale not determined |
More than ten days after being notified, Korean Air and Asiana had still not established their numbers. That gap tells you something about how hard it is for an airline to scope a breach that happened inside somebody else's system.
Amadeus has said payment data was held separately, and that it has rotated credentials and added monitoring.
Why the PNR matters more than it sounds
A reservation code looks harmless. It is not, and this is the practical core of the incident.
A PNR plus a name, a route and a travel date is everything needed to construct a message that cannot be distinguished from a real airline communication. Carriers are already warning travellers about fake refund and itinerary messages citing real flight details.
Consider what that looks like from the passenger's side. An email arrives referencing your actual booking reference, your actual flight, your actual seat, offering a refund or a schedule change. Every instinct people have been trained to use, checking whether the sender knows real details about you, fails here.
For the 2,000 whose passport numbers and nationality were taken, the risk extends into identity document fraud, which does not expire when the booking does.
Why it matters
Thirty-seven months is the headline, not ninety-two thousand. The detection failure is more significant than the record count. An intruder had access to a global reservation platform for over three years. One analyst comment captured the governance point: "Thorough oversight and monitoring of vendors in normal times" should be part of how a company's data protection capability is judged.
The airline did everything right and was still breached. JAL's own network was untouched. Its security programme, whatever its quality, was not the variable. This is the defining feature of third-party risk: the organisation that holds the customer relationship bears the consequence of a decision made inside a supplier it cannot audit in real time.
Centralised reservation platforms are concentrated targets. A handful of global distribution systems handle bookings for most of the world's airlines. One flaw in one of them reaches passengers across multiple continents and carriers simultaneously, which is exactly what happened here.
Travel data is social engineering fuel, not fraud material. There are no card numbers to monetise. What there is instead is an extremely high-quality targeting list: who is flying, where, when, and in which seat. That has a longer useful life than a stolen card and is harder for victims to defend against.
A vendor's initial assessment can be wrong. Amadeus said on 1 October that the vulnerability had not been exploited by ransomware actors. Three weeks later, customers were being notified of three years of unauthorised access. Initial vendor statements made during an ongoing investigation should be treated as provisional.
Scoping a third-party breach is slow. Two airlines could not say how many of their customers were affected more than ten days after notification. If your incident response plan assumes you can determine impact quickly, it assumes you control the systems involved.
Who is affected
Approximately 90,000 JAL Group customers whose reservation code, name and itinerary were exposed.
Approximately 2,000 JAL Group customers who additionally lost passport numbers, nationality and contact details. These people face a materially different risk.
Customers of All Nippon Airways, Cathay Pacific, Korean Air and Asiana Airlines, with scale still undetermined for two of them.
Anyone who flew with an affected carrier between August 2023 and September 2026, which is a wide window.
The wider travel sector, now facing questions about concentration risk in reservation platforms.
What to do
If you flew with an affected airline in that period
Treat any message citing your real booking details as suspect. Correct flight details are no longer evidence that a message is genuine. This is the single most important behavioural change.
Do not click links in refund, itinerary change or compensation messages. Go to the airline's app or type the address yourself.
Be especially cautious about telephone contact. A caller who knows your route, date and seat number sounds authoritative. Hang up and call the airline back on a number you looked up independently.
If you are in the 2,000 group, treat the passport exposure seriously. Passport numbers combined with nationality and full name support identity document fraud, and unlike a card number, a passport is slow and costly to replace.
Watch frequent flyer accounts for unauthorised redemptions, and change the password if it is reused anywhere.
Report suspicious contact to the airline, which helps them map the campaign.
For organisations with critical suppliers
Ask how long an intrusion could go undetected in your supplier's environment, and what monitoring would catch it. Thirty-seven months is the benchmark this incident sets.
Require notification timelines in contracts, and define what triggers them. JAL learned on 23 October about access that ended on 23 September.
Know which supplier holds which data fields. JAL could describe exactly what was exposed for each group, which suggests good records. Many organisations could not do the same.
Plan for the scoping delay. Build an incident playbook that works when you cannot see the affected systems and must wait on a third party for facts.
Treat initial vendor assessments as provisional and set a review point rather than closing the matter when the first statement sounds reassuring.
Prepare customer communications in advance for supplier breaches. You will be the one answering, regardless of whose system failed.
Final thoughts
Japan Airlines did not get hacked. Somebody got into the system that holds its bookings and stayed there from August 2023 until September 2026, and the airline found out a month after it ended, from the supplier. There is no action JAL's security team could have taken, because there was nothing on JAL's side to take it against.
The lesson: when you outsource a system, you outsource the ability to detect a breach in it, but you keep the obligation to answer for one. The customers getting phishing messages with their real seat numbers in them are JAL customers. The notification came from JAL. The reputational cost sits with JAL. Everything except the capacity to prevent it stayed with the airline.
The second lesson is about what kind of data this is. No card numbers were taken, which will tempt people to file this as a minor incident. That would be a mistake. What was taken is a precisely verified list of who was where, when, and in what seat, which is the raw material for the most convincing kind of fraud there is. The 90,000 people who "only" lost a booking reference are the ones most likely to receive a message this month that they have no good way to distinguish from a real one.
Two questions worth asking: how long could an intruder stay inside your most critical supplier before anyone noticed, and who would tell you?
