Japan Airlines breach via Amadeus hits 92,000 flyers

Japan Airlines (JAL) and subsidiary Japan Transocean Air (JTA) disclosed on 28 October 2026 that reservation data for about 92,000 customers may have been accessed after attackers breached Amadeus IT Group, the provider that runs their flight reservation, ticketing, and check-in systems. Amadeus notified JAL of the intrusion on 23 October. The disclosure was reported by The Record and confirmed across Japanese outlets including Impress Watch and TRAICY; JAL's own notice is the primary source.

What was exposed

• For roughly 90,000 customers: reservation numbers, names, travel dates, flight sectors, and travel classes.
• For about 2,000 customers: additionally contact details and passport numbers. (Reports vary on the exact field list for this group; some also cite frequent-flyer numbers, email addresses, and phone numbers.)
• Not compromised: credit card numbers and passwords, per JAL.

The exposed records span 10 August 2023 to 23 September 2026 — the window the data was present and reachable within Amadeus's systems, not booking or travel dates. JAL says flight operations were unaffected and that it has seen no confirmed misuse.

Not just JAL

This is an Amadeus-side compromise, not a JAL-side one — and JAL is not the only carrier hit. Korean Air and Asiana Airlines reported similar unauthorized access to customer data held at Amadeus in the same window. Any airline that outsources its passenger service system to Amadeus should treat this as a shared-platform incident, not a single-airline story.

What to do today

1. If you fly JAL/JTA, assume phishing. JAL says it will contact affected customers individually and warns of emails, calls, and fake sites impersonating the airline. Treat any "JAL breach" follow-up contact as suspect until verified through the airline's official channels.
2. Airlines on Amadeus: demand the intrusion timeline and scope from the provider, and review your own Amadeus tenant access logs across the 2023–2026 window.
3. High-value passport holders in the ~2,000 cohort should monitor for identity-document abuse; a passport number plus a name and itinerary is enough for travel-fraud and social-engineering attempts.

Context

The breach lands mid-wave for Japan. In the same stretch, Sony Network Communications reported 2.5 million records stolen, and GMO disclosed a forex-platform breach; Burger King Japan and Capcom have disclosed incidents affecting roughly 11 million people each. Prime Minister Sanae Takaichi convened a cabinet meeting on 26 October and pledged an emergency package. The through-line: large Japanese consumer brands are being hit through shared platforms and third-party providers, where one breached vendor exposes many customers at once.