Amadeus passenger system breach exposes booking data of about 92,000 JAL customers, 2,000 with passport numbers
Amadeus Altea passenger service system (Japan Airlines, Japan Transocean Air)
Japan Airlines and Japan Transocean Air disclosed on Oct 28 2026 that Amadeus IT Group, which runs their passenger service system for reservations, ticketing and check-in, told them on Oct 23 that an unauthorized access to its system exposed part of their reservation records from Aug 10 2023 to Sep 23 2026. About 92,000 customers are affected: about 90,000 had their booking code, name, flight date, route and class viewed, and about 2,000 also had email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers viewed. No card numbers or passwords leaked. Amadeus says it has completed security measures. ANA, also an Amadeus customer, says it was notified and is still checking.
Why this severity: About 92,000 travellers' booking records viewed, including passport numbers and contact details for about 2,000; no payment data or passwords
- Started
- Oct 23, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline4
JAL discloses the incident: about 92,000 customers affected. For about 90,000 the booking code (PNR), name, flight date, sector and class were accessed; for about 2,000 also email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers. No card numbers or passwords leaked, Amadeus says it has completed security measures, and no misuse has been confirmed. A dedicated hotline opens Oct 29.
All Nippon Airways, which also runs its reservations on Amadeus Altea, says it was notified by Amadeus too and is still checking whether and how it is affected.
Amadeus IT Group, which runs the passenger service system JAL uses for reservations, ticketing and check-in, tells Japan Airlines and Japan Transocean Air that an unauthorized access to its system exposed part of their customers' reservation data.
Start of the period (Aug 10 2023 to Sep 23 2026) in which Amadeus later found traces of outside access to part of the JAL and Japan Transocean Air reservation records held in its passenger service system.
Advisories2
News & write-ups4
- JAL、9万件超の予約情報に不正アクセス 一部はパスポート番号もNikkei · Oct 28, 2026
- JAL、9万件超の予約情報が漏えいか 一部は「氏名」「パスポート番号」「電話番号」も 海外委託先に不正アクセスITmedia · Oct 28, 2026
- 日航、全日空委外廠商遭駭 最多9.2萬筆個資疑遭閱覽Central News Agency (Taiwan) · Oct 28, 2026
- Japan Airlines (JAL) says Amadeus breach exposed 92k+ booking and 2000 passportsHacker News · Oct 28, 2026
Posts1
JALとJTA、約92,000人分の個人情報流出の可能性 アマデウスへの不正アクセス t.co/QzlNVONcZH t.co/lEBhFRv1Pa
Notes & caveats
JAL has not said how the attacker got into Amadeus's system or whether other Amadeus airline customers are affected. JAL moved its domestic and international reservations to Amadeus Altea in 2017; ANA completed its move to Altea in May 2026 and says it is checking its exposure.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
