Japan Airlines has confirmed that reservation information belonging to around 92,000 customers was accessed after a breach at Amadeus, the company that runs its passenger booking, ticketing and check-in systems. The disclosure covers both Japan Airlines and its group carrier Japan Transocean Air, and it underlines how a single supplier incident can ripple across several airlines at once.

According to the airline's announcement, Amadeus informed it on 23 October 2026 that unauthorised access to its systems had occurred between 10 August 2023 and 23 September 2026. For roughly 90,000 customers, the records involved reservation codes, names, flight dates, routes and travel classes. A smaller group of about 2,000 customers had additional details exposed, including email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers and flight, ticket and seat numbers. The airline said credit card numbers and passwords were not compromised, and that it had found no evidence of customer information being misused at the time of its announcement.

A wider problem across aviation

Japan Airlines does not appear to be the only carrier affected. Amadeus supplies technology to hundreds of airlines, airport operators and hotel groups worldwide, and other carriers including All Nippon Airways, Asiana Airlines and Korean Air have also reported customer-data incidents linked to the same supplier. Amadeus had already said on 1 October that it found a weakness in its travel booking display environment that could expose traveller data, and the Japan Airlines case suggests that weakness was exploited in practice.

What passengers should do

The airline said flight operations are unaffected and that Amadeus has now put the necessary security measures in place. It also said it will contact affected customers individually and has warned them to stay alert to phishing emails, fraudulent phone calls and fake websites impersonating the airline group. Anyone contacted about the incident should verify messages through the airline's official channels rather than following links in unexpected emails or texts.

Sources: BleepingComputer; teiss.