GoKawiilAmadeus breach exposes data of 92,000 Japan Airlines customers
Japan Airlines disclosed that unauthorized access to Amadeus's Passenger Service System, which handles reservations and check-in, occurred between August 2023 and September 2026 and exposed data on roughly 92,000 customers. For most, exposed details included reservation codes, names, flight dates, routes and travel class, while about 2,000 customers also had contact details, passport numbers, frequent flyer numbers and ticket information exposed. JAL said credit card numbers and passwords were not compromised and that Amadeus has since applied security fixes, with flight operations unaffected.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how a single vulnerability at a widely used aviation IT vendor like Amadeus, which serves over 400 airlines and hundreds of airports, can ripple across the industry, as shown by ANA also reporting a related breach. Amadeus initially said in October that no malicious exploitation had occurred, but JAL's disclosure suggests the flaw was in fact exploited, raising questions about how quickly such vulnerabilities are detected and communicated to client airlines. The long dwell time between 2023 and 2026 suggests the exposure may have gone unnoticed for years.
- About 92,000 JAL customers had data exposed via a breach at Amadeus's Passenger Service System.
- Unauthorized access reportedly spanned over three years, from August 2023 to September 2026.
- ANA has also reported a related data breach tied to Amadeus, suggesting broader industry impact.
Source: bleepingcomputer.com, 2026-10-29
Published there as: “Japan Airlines suffers third-party data breach exposing passenger info”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.