Japan Airlines said Amadeus, which runs its booking, ticketing and check-in system, told it on October 23, 2026 about traces of unauthorized access to Amadeus's own system. The traces indicate outsiders may have seen part of the reservation data for Japan Airlines and Japan Transocean Air. For about 90,000 customers, that meant booking code (PNR), name, flight date, route and travel class. For about 2,000 others, it also meant contact details, passport number, nationality, and frequent flyer, ticket and seat numbers.
JAL said card numbers and passwords were not affected, flights ran normally, and it has no sign of misuse. BleepingComputer reported, from JAL's announcement, that the access ran from August 10, 2023 to September 23, 2026. Amadeus said on October 1 it had found a flaw in its travel booking display environment, with no ransomware use. BleepingComputer says the flaw appears to have been exploited. JAL does not name the flaw or link it to this case.
JAL's customer data sat in a supplier's system, and JAL heard about the problem from that supplier. Buyers of such platforms can ask the vendor: How long do you keep booking records? What do you log, and for how long? How fast must you tell us of a breach? Who pays when you fail?