Japan Airlines Amadeus Data Breach Explained: 92,000 Customers, Six Airlines, What to Do

Illustrative image: a Japan Airlines Boeing 777 in flight. This is a stock photograph of the airline's aircraft, not a photo of the breach or of Amadeus systems. Image: Wikimedia Commons / Masahiro TAKAGI, CC BY.

TL;DR: Japan Airlines Amadeus data breach explained in one line: Japan Airlines says unauthorized access to the Amadeus reservation system exposed booking data for about 92,000 of its customers, and the same Amadeus system is now linked to disclosures from five more airlines — but no credit card numbers or passwords were involved, and flights are unaffected.

📌 KEY HIGHLIGHTS

• 92,000 JAL customers: Japan Airlines and Japan Transocean Air disclosed on 28 October 2026 that booking data for about 92,000 customers was accessed through Amadeus, their passenger-service system provider.
• Two tiers of exposure: about 90,000 customers had booking code, name, flight date, route and travel class accessed; about 2,000 more also had email, phone, passport number, nationality, frequent-flyer number, ticket and seat numbers accessed.
• Six airlines and counting: ANA disclosed on 29 October, Korean Air and Asiana disclosed on 23 October, and AIRDO, Solaseed Air and StarFlyer issued notices dated 29 October — all linked to Amadeus-managed reservations.
• What was NOT taken: Japan Airlines says credit card numbers and passwords were not compromised, and it had found no evidence of misuse when it disclosed the incident.
• The real risk now is scams: booking details make phishing emails and calls far more convincing, so treat any unexpected "airline" message asking for payment or a password as suspect.

Japan airlines amadeus data breach explained: what happened?

Japan Airlines (JAL) and its group carrier Japan Transocean Air (JTA) use Amadeus, the Spanish travel-technology company, to run passenger reservations, ticketing and check-in. On 23 October 2026, Amadeus told the two airlines it had found traces of external access to part of their passenger reservation data. Five days later, on 28 October, JAL made the incident public.

The records involved are for JL- and NU-coded flights whose reservation records existed in the Amadeus Passenger Service System between 10 August 2023 and 23 September 2026. That three-year window describes how long the records sat in the system — it does not mean every passenger who flew during that period is affected. JAL says it will contact affected customers individually.

Amadeus had already flagged a problem weeks earlier. On 1 October 2026 it published a statement saying it had found a vulnerability in its travel-booking display environment that could expose traveller data. At the time it said ransomware actors had not exploited the flaw and that no payment or financial data had been exposed. JAL's disclosure now indicates the flaw appears to have been maliciously exploited — though neither JAL nor Amadeus has described the incident as the exploitation of one specific software vulnerability, and the exact access mechanism has not been publicly confirmed.

What data was exposed — airline by airline

The picture is uneven, and that matters: only JAL has published a customer total so far. Do not apply JAL's 92,000 figure to any other airline.

Airline	Disclosed	What is confirmed so far
Japan Airlines + Japan Transocean Air	28 Oct 2026	About 92,000 customers: ~90,000 booking code, name, flight date, route, class; ~2,000 also email, phone, passport number, nationality, frequent-flyer number, ticket and seat numbers
Korean Air + Asiana Airlines	23 Oct 2026 (notified by Amadeus 20 Oct)	Booking numbers for some customers accessed; their notices say valid Amadeus system credentials were used without authorisation; payment information not included
ANA (All Nippon Airways)	29 Oct 2026	Unauthorized access to its Amadeus Altea system; signs some personal information was viewed; number, data types and period still under investigation
AIRDO, Solaseed Air, StarFlyer	Notices dated 29 Oct 2026 (via ANA)	Signs some customer personal information in Amadeus-managed reservations was viewed; no totals, fields or timing stated; scope still being identified

Illustrative image: server racks in a data centre. Airline reservation systems run on infrastructure like this — the breach was in the Amadeus software layer, not in this hardware. Image: Wikimedia Commons / NOIRLab / NSF / AURA / T. Slovinský, CC BY 4.0.

Why it matters for World Tech readers — and what it means for India

This is a supply-chain breach, not an airline-by-airline hack. Amadeus is one of the handful of companies whose systems sit behind bookings for hundreds of airlines, plus airports and hotels — BleepingComputer puts its reach at more than 400 airlines, 210 airport operators and 2 million hotels. One weak point in that shared layer produced disclosures across six airlines in a week, and investigators are still working out whether more airlines were affected. It is the same pattern as this month's other big stories — our Cisco ASA/FTD VPN flaw exploited explainer and our Volt Typhoon Silent Train explainer both turned on infrastructure most people never think about — except here the exposed asset is ordinary passengers' travel data, not servers.

For India, no Indian victims have been confirmed, and no Indian airline has disclosed an Amadeus-linked incident — so do not assume one. The relevance is practical: JAL flies between India and Tokyo, and countless Indian travellers book through travel agents and websites that run on Amadeus behind the scenes. If you have flown JAL, ANA, Korean Air or Asiana in the last few years, or booked them through an agent, the sensible move is to watch for unusually convincing scam messages using your real booking details — not to panic about your bank account, which this incident does not touch. If you receive a notice from one of these airlines, read it through the airline's own app or website, never through a link in the message itself. A related warning from a very different incident still applies: our UNM Health cyberattack explainer showed how fast stolen personal details get weaponised against the people they belong to.

Should you care?

✅ Verdict: Yes, if you flew JAL, ANA, Korean Air, Asiana or their partners in recent years — check for the airline's own notice, turn on alerts for your frequent-flyer account, and treat booking-related messages with suspicion. No, if you never flew these airlines: your money and passwords are not part of this incident, and there is nothing to fix. Either way, do not rebook, cancel or change a passport on the strength of an unsolicited message.

What to do if you flew one of these airlines

1. Wait for the airline's own notice. JAL says it will contact affected customers individually. ANA, AIRDO, Solaseed Air and StarFlyer say they will share details once their investigations confirm them. An unsolicited message is not the airline's notice until you verify it.

2. Never click through a booking message. Open the airline's app yourself, or type its website address yourself, and check the booking there. Do not pay a "fee", "confirm" a booking or share a password or verification code because a message asked you to.

3. Check your frequent-flyer account. Frequent-flyer numbers were among the exposed fields for about 2,000 JAL customers. Turn on account alerts and review recent activity for redemptions or changes you did not make.

4. If your passport number was exposed, ask your passport authority. A passport number alone is usually not enough to steal an identity, and JAL has not advised mass reissue — ask the authority what applies to your situation rather than guessing.

5. JAL customers can call the inquiry desk. JAL's dedicated desk opened on 29 October, weekdays 10 a.m. to 5 p.m. Japan time; the overseas number reported is +81-3-4332-7280. Confirm the current number on the airline's official notice before calling.

FAQs

What happened in the Japan Airlines Amadeus data breach?
Amadeus, which runs JAL's reservation, ticketing and check-in systems, told Japan Airlines on 23 October 2026 that it had found traces of external access to passenger reservation data. JAL disclosed on 28 October that about 92,000 customers were affected, and five more airlines have since disclosed linked incidents through the same Amadeus systems.

Was my passport number leaked in the JAL data breach?
Only for about 2,000 of the roughly 92,000 affected JAL customers did the accessed records include passport numbers, along with email addresses, phone numbers and frequent-flyer numbers. The other roughly 90,000 had booking code, name, flight date, route and travel class accessed — no passport number. JAL says it will contact affected customers individually.

Were credit card details or passwords stolen?
No. Japan Airlines says credit card numbers and passwords were not compromised, and Asiana likewise says payment information was not included. The incident exposed reservation and, for a smaller group, contact and identity details — not payment data.

Which airlines are affected by the Amadeus breach?
Confirmed so far: Japan Airlines and Japan Transocean Air (about 92,000 customers), Korean Air and Asiana Airlines (booking numbers for some customers), ANA (scope under investigation), and AIRDO, Solaseed Air and StarFlyer (notices dated 29 October, no totals stated). Investigators are still working out whether other airlines were affected, and it is not confirmed that every disclosure stems from one identical intrusion.

What should I do if I get a message about my booking?
Treat it as suspect until verified. Do not click its links or attachments, and do not share payment details, passwords or verification codes. Open the airline's app or type its website address yourself to check the booking, keep the suspicious message as evidence, and if you already entered credentials on a suspicious page, change them through the genuine service and review your account activity.

Are JAL flights affected?
No. Japan Airlines says flight operations are unaffected, and Amadeus says it has implemented the necessary security measures. The incident concerns historical reservation records, not current flight safety or schedules.

Takeaway: A single travel-technology supplier's weak point exposed 92,000 JAL customers' bookings and pulled five more airlines into the same story. Your money is not at risk from this incident — your inbox is. Verify every "airline" message through the airline itself.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

BleepingComputer — Japan Airlines suffers third-party data breach exposing passenger info (29 Oct 2026)
Kyodo News — ANA says customer info possibly leaked following unauthorized access (29 Oct 2026)
The Contrail — Amadeus Data Breach: Which Airlines Are Affected? (29 Oct 2026)
flyzeu — JAL/JTA reservation-data incident, updated 30 Oct 2026 (AIRDO, Solaseed Air, StarFlyer notices)
CyPro — JAL Data Breach Affects 92,000 Customers (28 Oct 2026)