Japan Airlines says Amadeus breach exposed data of about 92,000 customers

On 28 October 2026, Japan Airlines — Japan's flag carrier, headquartered in the Higashi-Shinagawa district of Tokyo — disclosed that booking data for approximately 92,000 customers had been exposed through a breach at its reservations technology provider, Amadeus IT Group. The airline said the intrusion did not affect its own systems and that the compromise occurred entirely within the third-party platform that handles its reservation, ticketing, and check-in operations.

According to JAL's notice, Amadeus reported that an unauthorized party had accessed "a portion of customer reservation data" for Japan Airlines and Japan Transocean Air flights. For the full set of roughly 92,000 affected customers, the exposed information included names, reservation codes, and flight details. For about 2,000 of those customers, the attacker also obtained passport numbers, frequent-flyer numbers, email addresses, and phone numbers. JAL said that credit-card numbers were not compromised and that the incident "never impacted flight operations."

A shared-platform compromise

The breach sits one layer below the airline, in the Amadeus reservation system rather than in JAL's own infrastructure — the same supply-chain exposure that affected other carriers relying on the provider, including Cathay Pacific, which separately disclosed that data from about 53,000 of its bookings had been accessed. Reporting on the Amadeus incident indicated that stolen system credentials were used to view reservation data over an extended period running from August 2023 until the access was closed in September 2026, though JAL's own notice did not specify the window.

Response

Japan Airlines said it would contact affected customers individually and warned them to be alert to phishing emails, fraudulent calls, and fake websites impersonating the airline, a pattern seen across the carriers caught up in the Amadeus breach. With the airline's own environment reported as unaffected and the third-party access said to have been closed, the incident's status is contained, while the broader investigation into the Amadeus compromise continued.