Unauthorized access occurred between August 10, 2023, and September 23, 2026, according to Amadeus’s notification to Japan Airlines on October 23, 2026.
Scope of the breach in Amadeus’s Passenger Service System
Japan Airlines (JAL) announced that a data breach at Amadeus’s Passenger Service System exposed the information of about 92,000 customers. JAL Group—operator of the airlines JAL and Japan Transocean Air—uses the Amadeus system for passenger reservations, ticketing, and check-in. Amadeus told the airline that unauthorized access occurred over a prolonged period ending on September 23, 2026, and that the vulnerability involved its travel booking display environment.
Exact data exposed and JAL’s immediate findings
JAL reported that approximately 90,000 customers had reservation codes (PNRs), names, flight dates, routes, and travel classes accessed. An additional roughly 2,000 customers had those data elements exposed plus email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers. JAL stated that credit card numbers and passwords were not compromised and that it currently has no evidence of customer information being misused. The airline also said Amadeus has implemented the necessary security measures and that flight operations are unaffected.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOther airlines and related service actions
The vulnerability at Amadeus appears to have affected multiple carriers. All Nippon Airways (ANA) announced a customer data breach tied to Amadeus, according to local media, and suspended certain related services on its website and mobile app since October 21. ANA’s suspension appears to be linked to the PHP2Shell threat rather than the Amadeus incident, according to reporting. South Korea’s Asiana Airlines and Korean Air have also confirmed impact from the Amadeus flaw.
Amadeus’s earlier disclosure and unanswered scope questions
On October 1, 2026, Amadeus published a statement saying it had discovered a vulnerability in its travel booking display environment that could expose travelers’ data. At that time the company said ransomware actors had not exploited the flaw and that no payment or other financial data had been exposed. Japan Airlines’ disclosure indicates the vulnerability was maliciously exploited in at least some cases. BleepingComputer reached out to Amadeus for more information about the broader scope—specifically whether additional airlines or other markets were affected—but the company had not provided further details as of publication.
What this means for technologists, regulators, and travelers
- Technologists and security teams: The incident highlights how long-lived access—here spanning more than three years—can affect large sets of traveler records once a vulnerability is present in a widely used platform. As the reporting notes, "once attackers are using valid credentials, prevention drops sharply," a point supported by measurements cited in the Blue Report 2026 that evaluated defenses across 338 million simulations.
- Regulators and procurement leaders: Amadeus supplies services to over 400 airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels, making visibility into incident scope and remediation plans essential for oversight and future contracting decisions.
- Travelers and frequent fliers: About 92,000 customers had personal or itinerary data accessed; roughly 2,000 had more sensitive identifiers exposed, including passport numbers. JAL’s statement that there is currently no evidence of misuse will be central to affected customers' decisions about monitoring communications and travel documents.
The breach underscores a practical risk in the travel sector: when a core technology supplier with a large footprint has a vulnerability, the consequences ripple across operators and customers. Amadeus’s October 1 disclosure and JAL’s October 23 notification together sketch a timeline in which discovery, public acknowledgement, and later customer impact have unfolded over weeks and, for the attackers, years. Questions about the full extent of exposure and the details of Amadeus’s remediation remain open as carriers and customers absorb the scale of the incident.
