Japan Airlines Data Breach: 92,000 Customers Exposed Through Amadeus, and the Vendor Checks Businesses Should Run

Japan Airlines says booking details for about 92,000 of its customers were viewed by outsiders, and the break-in happened at Amadeus, the outside company that runs its reservation system, not inside JAL. That matters to any company that hands customer data to a vendor for booking, payroll, CRM or hosting: when the vendor is breached, your customers get your notice, call your phone line and hold your name responsible.

Here is what JAL, Amadeus and the Korean airlines involved have said, what is still unknown, and the vendor checks worth running this week.

What happened in the Japan Airlines data breach

On October 28, 2026, JAL and its subsidiary Japan Transocean Air (JTA) announced that Amadeus, which runs the passenger service system they use for reservations, ticketing and check-in, had suffered unauthorized access. Amadeus told JAL on October 23. Parts of the booking records for JAL and JTA flights were viewed from outside between August 10, 2023 and September 23, 2026, a window of more than three years.

JAL split the affected customers into two groups:

JAL says credit card numbers and passwords were not exposed, it has found no misuse of the data so far, flights were not affected, and Amadeus has finished its security fixes. JAL will contact affected customers one by one and is warning people about fake emails, calls and websites that pretend to be the JAL Group.

One note on sourcing: JAL's websites could not be reached when we checked, so the JAL figures above come from matching reports of its announcement by BleepingComputer and the Japanese trade outlet Travel Voice.

What is confirmed and what is only claimed

Confirmed by Amadeus itself. In a statement posted in October, Amadeus said it found a vulnerability in a "travel booking display environment" and that "certain booking-display data was accessible through the vulnerability." It says it has no evidence that payment or financial data was accessed, no sign the flaw was used for ransomware, and that it has fixed the vulnerability, strengthened monitoring and contacted its customers and the authorities. It says its investigation is ongoing.

Reported by the airlines. Korean Air and Asiana Airlines have also said they were affected. According to The Korea Times, Korean Air has confirmed that some customers' booking reference numbers were exposed, Asiana says reservation information was involved but payment data sits in a separate system, and neither has said how many customers are affected. Both say their own internal systems show no sign of a breach.

Claimed, not confirmed by Amadeus. Korean press, citing the airlines, say the access used login credentials assigned to an account in Amadeus's system, and that Amadeus is blocking the access and monitoring the dark web. Amadeus's own statement describes a vulnerability and does not mention stolen credentials. We could not open the airlines' own notices to check that wording.

Not known yet:

• How many airlines, and how many passengers worldwide, are affected
• Whether the vulnerability and the reported account login are the same problem or two parts of one attack
• Who was behind it
• Why access ran for more than three years before it was found

Why a vendor breach is your breach too

JAL's own network was not the way in, yet JAL is the one running a call center, writing to customers and answering reporters. That is how a third-party data breach works for any business. The vendor holds the data, but the customer relationship, and the blame, stay with you.

Three parts of this story apply well beyond airlines:

1. You rely on the vendor's detection. If the reported dates are right, the access went on for more than three years. You cannot spot that from your side, so how a vendor watches its systems and how fast it tells you is a real business risk.
2. Vendor accounts sit outside your security rules. If the credential claim holds up, the way in was an account login, not an exotic exploit. Your MFA policy, offboarding steps and password rules do not cover accounts inside a vendor's system unless your contract says so.
3. The follow-up scam is the bigger danger. A name, booking code and email address make convincing phishing material. That is why JAL's first advice is to watch for fake messages.

If you flew JAL, Korean Air or Asiana

• Watch for a direct notice from the airline. JAL says it is contacting affected customers individually.
• Treat any email, text or call about your booking with suspicion. Go to the airline's site or app yourself rather than clicking a link.
• Change your frequent flyer password if it is reused anywhere else, and turn on extra login protection if the airline offers it.
• If you are in the passport group, watch for messages asking you to "verify" passport details. Airlines do not need you to send them by email.

Third-party vendor risk checklist for this week

Japan Airlines breach questions people are asking

Was Japan Airlines hacked?

Not directly. JAL says the unauthorized access was at Amadeus, the company that runs its passenger service system. Korean Air and Asiana also say their own systems show no sign of a breach.

Was my credit card stolen in the JAL data breach?

JAL says credit card numbers and passwords were not exposed. Amadeus says it has no evidence that payment or financial data was accessed.

How do I know if my JAL booking was affected?

JAL says it will contact affected customers individually. The records involved are bookings on JAL and JTA flights held by Amadeus between August 10, 2023 and September 23, 2026.

What is Amadeus?

Amadeus is a travel technology company. Airlines use its systems to handle reservations, ticketing and check-in, which is why one problem there can affect several airlines at once.

Are Korean Air and Asiana affected by the Amadeus breach?

Yes, both have said so. Korean Air has confirmed booking reference numbers were exposed. Neither has published how many customers are affected.

Was the Amadeus breach ransomware?

Amadeus says there are no signs the vulnerability was used for ransomware.

The bigger lesson

You can outsource a system, but not the responsibility for the data inside it. JAL's own network held up, and it is still the name on the breach notice. The businesses that handle a vendor breach well are the ones that already know which vendors hold what, have locked down their vendor accounts, and have a customer message ready before they need one.

Want help reviewing vendor access and tightening the accounts around your data? See security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Amadeus statement; BleepingComputer; Travel Voice; The Korea Times.