The JAL data breach has exposed reservation information belonging to approximately 92,000 customers. Japan Airlines disclosed the incident on 28 October 2026, five days after receiving notification from its passenger service system provider, Amadeus IT Group.
The incident also affects Japan Transocean Air, a JAL Group carrier. Japan Airlines said there was no evidence of data misuse and no impact on flight operations at the time of its announcement.
What happened in the JAL data breach?
Amadeus informed Japan Airlines and Japan Transocean Air on 23 October 2026 that traces of external access had been identified within parts of its passenger reservation environment. The affected system supports airline reservations, ticketing and check-in processes.
Japan Airlines made the incident public on 28 October 2026. Its notice confirmed that the exposed information related to reservations for flights with JL or NU flight numbers that existed within the Amadeus Passenger Service System during the affected period.
The access window ran from 10 August 2023 to 23 September 2026. This describes the period in which the records were present and accessible within the Amadeus system. It does not necessarily represent the dates when customers booked or took their flights.
Japan Airlines migrated to the Amadeus Passenger Service System in 2017. No specific software version has been identified in the current disclosures, and neither JAL nor Amadeus has described the incident as the exploitation of a particular software vulnerability.
Which customer records were exposed?
The information involved in the JAL data breach differs across two groups of customers. For approximately 90,000 people, the accessible reservation records included:
- Passenger name record codes, commonly known as PNR or booking reference codes
- Customer names
- Flight dates
- Flight sectors or routes
- Class of service
A further group of approximately 2,000 customers had a broader set of personal and travel information exposed. Depending on the individual record, this could include:
- Email addresses and telephone numbers
- Passport numbers and nationalities
- Frequent flyer membership numbers
- Airline names and flight numbers
- Ticket numbers and seat numbers
JAL said credit card numbers and account passwords were not included in the affected dataset. This limits the immediate risk of direct payment fraud or password compromise, but the combination of identity, contact and journey information remains useful for targeted social engineering.
JAL data breach timeline and affected airlines
The earliest identified access occurred on 10 August 2023. Traces of external access continued within the relevant Amadeus environment until 23 September 2026, creating an exposure period of more than three years.
Related notices from Korean Air and Asiana Airlines provide additional context. Amadeus notified those carriers on 20 October 2026, and both subsequently issued customer notices concerning unauthorised access connected to Amadeus system accounts.
Amadeus notified Japan Airlines and Japan Transocean Air on 23 October 2026. JAL then publicly disclosed the breach on 28 October 2026, with its dedicated customer inquiry line scheduled to open on 29 October 2026 JST.
The confirmed timeline is:
- 10 August 2023: The estimated external access period begins.
- 20 October 2026: Amadeus notifies Korean Air and Asiana Airlines about related access.
- 23 September 2026: The estimated access period ends.
- 23 October 2026: Amadeus informs Japan Airlines and Japan Transocean Air.
- 28 October 2026: Japan Airlines publicly discloses the incident.
- 29 October 2026: JAL’s dedicated inquiry line opens for affected customers.
Some reporting listed 23 September 2024 as the end of the access period. JAL’s notice and corroborating reports confirm that the correct date is 23 September 2026.
How the Amadeus account access may have worked
JAL has not publicly specified the precise access mechanism. However, official notices from Asiana Airlines and Korean Air concerning the same Amadeus incident state that valid credentials assigned to Amadeus system accounts were used without authorisation.
This suggests misuse of legitimate account access rather than exploitation of a newly discovered software flaw. An attacker using valid credentials can potentially appear to be an authorised user, making suspicious activity more difficult to identify unless account behaviour, data access patterns and authentication events are closely monitored.
The related airline notices describe an estimated activity window consistent with the dates reported by JAL. However, there is no public attribution to a particular threat actor, and JAL has not explicitly confirmed that the same credential mechanism was used to reach its customers’ records.
Amadeus has completed what JAL described as the necessary security measures. No technical indicators of compromise, such as malicious IP addresses, domains or file hashes, had been published by JAL or Amadeus as of 28 October 2026.
Current exploitation and operational status
The JAL data breach represents confirmed unauthorised access rather than a theoretical security weakness. Traces showed that external parties had accessed portions of reservation data, although it has not been disclosed whether records were downloaded or subsequently distributed.
Japan Airlines reported no evidence that the exposed information had been misused. It also said the incident caused no disruption to flight operations, reservations, check-in services or other operational activities.
No proof of concept or exploit code is relevant to the current disclosure because no software vulnerability has been identified. The primary issue is unauthorised access at a technology provider handling reservation information for multiple airlines.
Why the JAL data breach matters
Airline reservation records can provide convincing material for phishing and impersonation. A message containing a passenger’s name, route, booking reference or flight date may appear more credible than a generic scam.
The approximately 2,000 customers whose contact and passport information may have been exposed face an additional risk of targeted fraudulent calls, emails or websites. JAL has specifically advised customers to remain alert to phishing, suspicious calls and spoofed sites impersonating the JAL Group.
The event also demonstrates how a compromise within a shared technology provider can affect several organisations without attackers first breaching each airline’s internal network.
What organisations should do now
Organisations using cloud or outsourced platforms should confirm which customer fields their suppliers store, how long records remain available and how quickly the supplier must report unauthorised access. Contracts and incident plans should address credential abuse as well as conventional software vulnerabilities.
Businesses should also prepare customer communications that identify exactly which data fields were involved. Following the JAL data breach, travel-related emails, unexpected booking changes and requests for passport or account information should receive additional scrutiny, particularly when they direct recipients to unfamiliar websites or telephone numbers.
Originally reported by The Standard (HK).
