A hack at travel software maker Amadeus exposed data on about 92,000 Japan Airlines customers, and passengers of three other airlines also report impact.
Japan Airlines says a company it never built itself, the booking software maker Amadeus, leaked data on about 92,000 of its customers. Amadeus told the airline on October 23, 2026 that someone had broken into its systems. The access lasted from August 10, 2023 to September 23, 2026. That is more than three years.
JAL Group, which runs Japan Airlines and Japan Transocean Air, uses the Amadeus system for reservations, ticketing and check-in. For about 90,000 customers, the intruder saw booking codes, names, flight dates, routes and travel classes.
For another 2,000 customers, the exposure went further. Their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers were also accessed.
JAL says credit card numbers and passwords were not compromised. It also says it has no evidence so far that anyone has misused the information. Flight operations are not affected, and JAL says Amadeus has now put the necessary security measures in place.
This is not only a Japan Airlines story. Amadeus supplies software to over four hundred airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. All Nippon Airways has announced a customer data breach tied to Amadeus, according to local media. Asiana Airlines and Korean Air have also confirmed impact.
ANA has also paused some website and app services since October 21. That step appears linked to a different threat called PHP2Shell, not the Amadeus incident.
Booking details are useful to scammers. A fake email that names your real flight, route or booking code looks convincing. Passport numbers add a bigger risk, because they can be used in identity fraud. If you flew with any of these airlines, treat unexpected messages about a trip with extra suspicion.
The alert box above lists the steps to take. The main ones are to check your airline's notice, be careful with links, and protect your frequent flyer account.
Amadeus first posted a statement on October 1, 2026 about a flaw in its travel booking display environment. It said then that ransomware groups had not used the flaw and that no payment data was exposed. JAL's notice suggests the flaw was in fact exploited by attackers.
Still unknown is how many airlines and countries are affected in total. BleepingComputer asked Amadeus, but the company had not answered at the time of publication. More airlines may yet come forward.
If you flew JAL, ANA, Asiana or Korean Air, check the airline's notice and distrust any unexpected message about your trip.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
