Japan Airlines Breach Hits 92,000 Passengers via Amadeus

Japan Airlines was not hacked directly. The breach sits one layer down, in the Amadeus system that handles its reservations, ticketing and check in. What leaked still matters: real booking codes, flight dates and routes. Those details turn a generic scam email into one that reads exactly like a message from your airline.

Key Takeaways

• Japan Airlines and Japan Transocean Air disclosed on October 28, 2026 that unauthorized access to the Amadeus Passenger Service System exposed reservation data for approximately 92,000 customers.
• Amadeus informed the two airlines on October 23, 2026, and the traces of external access span August 10, 2023 to September 23, 2026.
• About 90,000 customers lost their reservation code, name, flight date, flight sector and class of service, while about 2,000 also lost their email address, phone number, passport number, nationality and frequent flyer number.
• JAL says no credit card numbers or passwords were compromised and that it has no evidence so far of customer information being misused.
• JAL will contact affected customers individually and warns of phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group.

What Happened at Japan Airlines?

An outside party got into the Passenger Service System that Amadeus IT Group runs for JAL, and read part of the airline's reservation data. According to the official JAL notice, Amadeus informed Japan Airlines and its group carrier Japan Transocean Air on October 23 that traces were found indicating "a portion of customer reservation data had been accessed externally." The two airlines published the notice five days later, on October 28.

JAL says Amadeus has finished its security fixes, that flight operations were never affected, and that it has seen no misuse of the data so far. The airline opened a dedicated inquiry desk on October 29.

What Passenger Data Was Exposed?

JAL's notice splits the affected passengers into two groups, and the difference between them is large:

• About 90,000 customers: reservation code (PNR), name, flight date, flight sector and class of service.
• About 2,000 customers: all of the above plus email address, phone number, passport number, nationality, frequent flyer number, airline name, flight number, ticket number and seat number.

JAL states there was "no compromise of credit card numbers or any passwords." That includes the password on your JAL Mileage Bank account. The notice does not say how the 2,000 richer records were selected.

That split is what separates JAL from the Capcom ID breach earlier this month, where 11.77 million email addresses were the core of the leak. At JAL, roughly 98 percent of affected passengers had no email address or phone number exposed at all.

How Long Were the Attackers Inside Amadeus?

The traces JAL lists run from August 10, 2023 to September 23, 2026. That is 1,140 days, a little over three years. Amadeus then took another month to tell JAL.

According to BleepingComputer, Amadeus published a statement on October 1, 2026 about a vulnerability in its travel booking environment and said at the time that ransomware actors had not exploited the flaw. JAL's notice now confirms that customer data was in fact accessed. BleepingComputer also reports that Asiana Airlines and Korean Air have confirmed impact, and that All Nippon Airways announced a customer data breach tied to Amadeus. Amadeus systems are used by over four hundred airlines, and BleepingComputer says the company had not answered questions about the full scope.

For compliance teams, this is the uncomfortable part: JAL lost data through a booking system it does not run. A three year dwell time inside a shared platform means 92,000 is JAL's count only, and every carrier on the same platform has to run the same check.

What This Means for Your Inbox

Airline phishing works because people expect airline email, and a real booking code in the subject line removes the last doubt. The leaked fields give a scammer exactly that: your name, your reservation code, the date and route you flew, and the cabin you sat in.

Most coverage frames the risk as fake flight change emails. The access window points somewhere else. Bookings accessed between 2023 and September 2026 are mostly for trips that have already happened. That makes the likelier lure a backward looking one: a refund for a delayed flight, compensation for the breach itself, or miles that were never credited. JAL's notice mentions no compensation program, so any email offering breach compensation for a JAL booking deserves extra suspicion.

The 90,000 passengers without exposed contact details are not off the hook either. Japan is absorbing several large leaks at once. The Record lists 2.5 million people in the Sony So-net breach, 11.7 million at Capcom and 11 million at Burger King Japan, and reports that Prime Minister Sanae Takaichi called the situation serious and promised a package of emergency measures. Criminals routinely merge leaks by name, so a JAL booking record can be matched to an email address that leaked somewhere else. The same pattern played out in the Reservation Hijack hotel scam , where phishing emails quoted each guest's real reservation.

How Can You Tell a Real JAL Email From a Fake?

You cannot tell from the content alone, because a fake can now quote your real booking. Check the channel instead:

• Compare the sender with an old confirmation. Compare the sending address with a JAL booking email you received before October 2026. Lookalike domains are the usual giveaway.
• Check authentication in Gmail. Open the message, click the arrow under the sender name, and look at the mailed-by and signed-by lines. Google's guide to avoiding and reporting phishing emails explains the warnings Gmail shows for unauthenticated mail.
• Never act from the link. To check a booking, refund or mileage balance, type the JAL website address yourself or open the JAL app.

What Should JAL Passengers Do Now?

If you flew JAL or Japan Transocean Air since 2023, do this now. The phone numbers come from JAL's notice.

1. Call the dedicated desk yourself if you are unsure. Within Japan: 0120-25-6050 or 03-4332-7280. From overseas: +81-3-4332-7280. Hours are 10:00 to 17:00 JST, Monday through Friday, excluding Japanese national holidays. Dial these numbers directly rather than any number quoted in an email or text.
2. Expect individual contact, and verify it. JAL says it will contact affected customers individually. Its notice does not say through which channel, so confirm any message that claims to be that notice through the desk above.
3. Harden your JAL Mileage Bank account. Passwords were not exposed, but about 2,000 people lost their frequent flyer number, which is half of a login. Make sure the password is unique to JAL, and check your mileage history for redemptions you did not make.
4. Treat calls about your passport as suspect. The 2,000 group lost passport numbers and nationality. A caller who reads your passport number back to you has proven only that they have the leak.
5. Secure the email address on your booking. Turn on two step verification for that mailbox so one phishing click cannot cost you the inbox.

Looking Ahead

The open questions sit with Amadeus, not JAL: how the attacker got in, why access went undetected from August 2023, and how many other airlines' passengers are in the same position. Until those answers arrive, assume more carriers will publish notices like this one, each followed by a wave of emails quoting real bookings. Booking.com also promised in April that everyone would be notified individually after its reservation data breach. Individual notices help, but the scam emails rarely wait for them.