Japan Airlines has warned roughly 92,000 customers that hackers accessed their personal information through a third-party reservation platform, in what is turning out to be one of the most critical data security incidents to hit the global aviation industry in recent memory.
The airline said the breach originated at Amadeus IT Group, the Spain-based technology company whose software powers ticketing, check-in, and reservation systems for airlines worldwide. JAL said Amadeus notified it the week before it published its own disclosure notice on October 28, 2026, stating that an unauthorized party had accessed "a portion of customer reservation data" stored within the Amadeus platform.
For the vast majority of affected customers, the exposed information included names, booking reference codes, and flight details. But for approximately 2,000 of those customers, the picture is considerably worse. Hackers also accessed passport numbers, frequent-flyer numbers, email addresses, and phone numbers. No credit card numbers or passwords were compromised, JAL said, because that data was not stored in the same system.
Japan Transocean Air, a JAL affiliate, was swept up in the same incident. The two carriers share infrastructure through the Amadeus platform, which is how the breach spread across both brands without requiring a separate intrusion.
JAL said it would reach out to affected customers individually and urged everyone to stay alert for phishing emails, fraudulent phone calls, and fake JAL websites. The warning carries real weight: when scammers know your name, flight number, and booking code, their messages tend to look far more convincing than a generic blast.
The company said its own internal systems were not touched. That distinction, while technically accurate, offers only limited reassurance. From a customer's perspective, the data was real, the exposure was real, and JAL was the brand they trusted when they handed over their information.
JAL is far from alone in this. The Amadeus breach has since grown into an industry-wide event. Cathay Pacific disclosed that hackers used login credentials assigned to one of its system accounts to access reservation data inside Amadeus, with the intrusion running from August 2023 to September 2026, a window of more than three years. Amadeus reportedly detected the unauthorized access in late September, then reset the compromised credentials, disabled the account, and added monitoring. Airlines were notified between October 20 and October 28.
ANA, another major Japanese carrier, said about 37,800 of its customers were affected, with roughly 1,700 of those having passport details viewed. Cathay Pacific put its figure at approximately 53,000 bookings. Korean Air, Asiana Airlines, Malaysia Airlines, and German leisure carrier Condor have all said they are investigating their exposure. Qantas was still assessing whether its bookings were affected as of early November. Three smaller Japanese regional carriers, Air Do, Solaseed Air, and Starflyer, said they had been notified and were reviewing their records.
No single overall figure covering all airlines has been published, but the numbers keep climbing.
The mechanism behind the breach is straightforward and deeply familiar to anyone who follows enterprise security incidents. At its core, attackers used legitimate credentials to log into a system they were not supposed to access. No elaborate zero-day exploit, no ransomware deployment. Someone had the right username and password, and they used it. Cathay Pacific's disclosure that the credentials were tied to a "system account" suggests the compromised login may not have belonged to a human employee at all, but rather to an automated or service-level account, which tend to receive less routine monitoring than individual user logins.
The timeline raises its own troubling questions. If the unauthorized access began in August 2023 and was not detected until September 2026, attackers had more than three years to move through reservation data at their leisure. It is not yet clear whether that access was continuous or sporadic, or whether the full scope of what was taken is known.
The disclosure lands at a sensitive moment for Japan's cybersecurity posture. The country has seen a string of high-profile incidents over the past two years, and Prime Minister Sanae Takaichi convened a cabinet meeting on the issue, pledging emergency measures, though specifics had not been released at the time of publication.
For passengers, the practical exposure is primarily the risk of targeted fraud. Scammers with access to real booking records can craft fake refund notices or schedule-change alerts that clear most basic suspicion checks. Security researchers consistently advise the same response: access your booking only by typing the airline's official website address directly into your browser, and treat any unsolicited message about your flight as suspicious until verified through official channels.
Amadeus has not issued a detailed public statement about how the breach occurred, its full scope, or what it is doing to prevent a similar incident. As more airlines finish their own assessments, that number is likely to rise.
