# Amadeus passenger system breach exposes booking data of about 92,000 JAL customers, 2,000 with passport numbers · pwn.watch > Japan Airlines and Japan Transocean Air disclosed on Oct 28 2026 that Amadeus IT Group, which runs their passenger service system for reservations, ticketing and check-in, told them on Oct 23 that an unauthorized access to its system exposed part of their reservation records from Aug 10 2023 to Sep 23 2026. About 92,000 customers are affected: about 90,000 had their booking code, name, flight date, route and class viewed, and about 2,000 also had email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers viewed. No card numbers or passwords leaked. Amadeus says it has completed security measures. ANA, also an Amadeus customer, says it was notified and is still checking. Page: https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026 · generated 2026-10-28T22:05:28.248Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: Amadeus Altea passenger service system (Japan Airlines, Japan Transocean Air) - Started: 2026-10-23 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026.json - This file: https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: JAL discloses the incident: about 92,000 customers affected. For about 90,000 the booking code (PNR), name, flight date, sector and class were accessed; for about 2,000 also email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers. No card numbers or passwords leaked, Amadeus says it has completed security measures, and no misuse has been confirmed. A dedicated hotline opens Oct 29. (https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) - 2026-10-28: All Nippon Airways, which also runs its reservations on Amadeus Altea, says it was notified by Amadeus too and is still checking whether and how it is affected. (https://www.cna.com.tw/news/aopl/202610280301.aspx) - 2026-10-23: Amadeus IT Group, which runs the passenger service system JAL uses for reservations, ticketing and check-in, tells Japan Airlines and Japan Transocean Air that an unauthorized access to its system exposed part of their customers' reservation data. (https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) - 2023-08-10: Start of the period (Aug 10 2023 to Sep 23 2026) in which Amadeus later found traces of outside access to part of the JAL and Japan Transocean Air reservation records held in its passenger service system. (https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) ## Fix brief # Security brief: Amadeus passenger system breach exposes booking data of about 92,000 JAL customers, 2,000 with passport numbers Source: https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 18:58 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Japan Airlines and Japan Transocean Air disclosed on Oct 28 2026 that Amadeus IT Group, which runs their passenger service system for reservations, ticketing and check-in, told them on Oct 23 that an unauthorized access to its system exposed part of their reservation records from Aug 10 2023 to Sep 23 2026. About 92,000 customers are affected: about 90,000 had their booking code, name, flight date, route and class viewed, and about 2,000 also had email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers viewed. No card numbers or passwords leaked. Amadeus says it has completed security measures. ANA, also an Amadeus customer, says it was notified and is still checking. Severity detail: About 92,000 travellers' booking records viewed, including passport numbers and contact details for about 2,000; no payment data or passwords - Product: Amadeus Altea passenger service system (Japan Airlines, Japan Transocean Air) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you booked a JAL or JTA flight between August 2023 and September 2026, expect phishing emails, calls and fake sites that quote your booking code, name and itinerary; JAL will contact affected customers individually, so don't act on unexpected messages asking for card details or a login. If you are among the roughly 2,000 whose passport number and contact details were viewed, be extra wary of identity-verification scams. JAL's hotline (+81-3-4332-7280, 0120-25-6050 in Japan) opens Oct 29, weekdays 10:00-17:00 JST. ## Latest updates - Oct 28, 2026: JAL discloses the incident: about 92,000 customers affected. For about 90,000 the booking code (PNR), name, flight date, sector and class were accessed; for about 2,000 also email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers. No card numbers or passwords leaked, Amadeus says it has completed security measures, and no misuse has been confirmed. A dedicated hotline opens Oct 29. - Oct 28, 2026: All Nippon Airways, which also runs its reservations on Amadeus Altea, says it was notified by Amadeus too and is still checking whether and how it is affected. - Oct 23, 2026: Amadeus IT Group, which runs the passenger service system JAL uses for reservations, ticketing and check-in, tells Japan Airlines and Japan Transocean Air that an unauthorized access to its system exposed part of their customers' reservation data. - Aug 10, 2023: Start of the period (Aug 10 2023 to Sep 23 2026) in which Amadeus later found traces of outside access to part of the JAL and Japan Transocean Air reservation records held in its passenger service system. ## Advisories - [Regarding Unauthorized Access to Amadeus Passenger Service System](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) (Japan Airlines) - [Amadeus社が提供する旅客サービスシステムへの不正アクセスについて](https://www.jal.co.jp/ja-jp/news/general/2026/other/261028.html) (Japan Airlines) ## Write-ups & news - [JAL、9万件超の予約情報に不正アクセス　一部はパスポート番号も](https://www.nikkei.com/article/DGXZQOUC288G50Y6A021C2000000/) - [JAL、9万件超の予約情報が漏えいか　一部は「氏名」「パスポート番号」「電話番号」も　海外委託先に不正アクセス](https://www.itmedia.co.jp/business/articles/2610/28/news078.html) - [日航、全日空委外廠商遭駭　最多9.2萬筆個資疑遭閱覽](https://www.cna.com.tw/news/aopl/202610280301.aspx) - [Japan Airlines (JAL) says Amadeus breach exposed 92k+ booking and 2000 passports](https://news.ycombinator.com/item?id=50279029) ## Caveats JAL has not said how the attacker got into Amadeus's system or whether other Amadeus airline customers are affected. JAL moved its domestic and international reservations to Amadeus Altea in 2017; ANA completed its move to Altea in May 2026 and says it is checking its exposure. --- Machine-readable: https://pwn.watch/i/amadeus-passenger-system-breach-jal-92k-customers-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.