- Japan Airlines says a breach at its reservation vendor, Amadeus, exposed data on about 90,000 customers, with about 2,000 more losing passport numbers and contact details.
- The airline says Amadeus told it on October 23, 2026. BleepingComputer reports that Asiana Airlines and Korean Air also confirmed impact from the Amadeus flaw.
- Leaders should map which vendors hold customer records, how fast each must notify them, and how little personal data those vendors really need.
When you book a flight, you trust an airline. Behind that airline sits a vendor you may never have heard of. It holds your name, your route and sometimes your passport number. When that vendor is breached, the airline may learn about it only when the vendor tells it.
What Japan Airlines says happened
Japan Airlines (JAL) said Amadeus IT Group told it on October 23, 2026 that someone had accessed Amadeus's systems without permission. Amadeus provides JAL's Passenger Service System. JAL describes it as the platform that brings together reservations, ticketing and check-in.
JAL says traces showed part of its customer reservation data was accessed from outside. About 90,000 customers had their reservation code, name, flight date, route and class of service exposed.
For roughly 2,000 people the exposure went further. JAL lists their email address, phone number, passport number and nationality. It also lists frequent flyer, ticket and seat numbers, among other items.
JAL says no credit card numbers or passwords were compromised. It says it has no evidence that customer information has been misused, and that flights were not affected. It also says Amadeus has completed the necessary security measures.
Why a shared reservation platform is a concentrated target
A Passenger Service System is the record-keeper of an airline. Every booking, ticket and check-in passes through it. That is why a single weakness there can reach so many people.
BleepingComputer, which covered JAL's announcement, calls Amadeus a major supplier to global aviation. Its customers, the outlet says, include more than 400 airlines and 2 million hotels. The outlet also reports that Amadeus did not answer its question on whether more airlines or countries were affected.
Here is our interpretation. When one platform serves many airlines, their reservation records sit behind a common set of defences. A flaw in that platform is not one airline's problem. Each airline inherits it.
BleepingComputer links the incidents at JAL, Asiana and Korean Air to the same Amadeus flaw. It reports ANA's breach as tied to Amadeus, citing local media. Amadeus has not said how far the problem reaches, so the full scope is not yet established.
What the weak point tells us
BleepingComputer reports that Amadeus posted a notice on October 1, 2026. It described a weakness in what it called its "travel booking display environment" that could expose travelers' data. In the same notice, Amadeus said it saw no sign that ransomware groups had used the flaw, and that no payment data was involved.
BleepingComputer also reports that the unauthorized access ran from August 10, 2023 to September 23, 2026. That is more than three years. The outlet says JAL's confirmation suggests the flaw was maliciously exploited.
The sources do not explain how the attackers got in or how many records were taken in total. They do not say which parts of the system were touched. We can still reason from the name. A display layer exists to show stored bookings to people who ask for them. Any such layer must be able to read reservation records. If it can be tricked into showing too much, the records behind it are exposed. That is an inference, not a finding from the sources.
Why a reservation code is not harmless
A reservation code and a name look harmless. Add a flight date and route, and a scammer can write a message that looks like it came from the airline. For the 2,000 people whose phone numbers and seat numbers were also exposed, such a message could be more convincing. JAL itself asks customers to watch for phishing emails, fraudulent calls and fake websites that imitate the group.
The lesson here is that vendor risk is not a technical footnote. It decides how much of your customers' lives sits in someone else's database. Customers never signed that contract. Their trust in your brand is what is exposed.
Questions to ask your own vendors
Start with a simple list of every outside system that holds customer records. Then put four questions to each vendor's account owner.
First, what must the vendor tell you, and how fast, in writing? That covers both a newly found flaw and confirmed access to your data. The sources show two dates here. Amadeus posted a public notice about a flaw on October 1, and JAL says it was told of access on October 23. They do not show whether, or when, Amadeus told JAL about the flaw itself before October 23. They also do not show whether any contract deadline was missed. Ask your vendor which events start which clock.
Second, how long do the vendor's logs go back? A window of more than three years only becomes visible if someone kept the records.
Third, which fields does the vendor actually need? Passport numbers sat in only about 2,000 of the affected records. Storing less shrinks every future notice.
Fourth, is your customer-facing team ready to warn people about phishing within days of a vendor notice?
An airline can lock its own doors and still lose the guest list from the building next door.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Japan Airlines (JAL Group).
