Japan Airlines Airbus A350. Photo: Phuong D. Nguyen / Shutterstock Serious information security incident at Japan Airlines (JAL): The company announced that information on approximately 92,000 passengers could have been exposed following unauthorized access to Amadeus systems, which provides it and its subsidiary Japan Transocean Air with systems for managing reservations, ticketing, and boarding processes.
According to the company's announcement, on October 23, 2026, Amadeus reported evidence that information from customer order records was accessed outside the system without authorization. The period in which the information was identified as potentially accessible is from August 10, 2023, to September 23, 2026.
According to details released by Japan Airlines, about 90,000 cases involved some of the booking details, including the booking number, passenger name, travel date, flight route and class of service. About 2,000 additional cases also included more sensitive details, including email addresses, phone numbers, passport numbers, citizenship, loyalty club membership numbers and other details.
The company clarified that no indications of a leak of credit card numbers or passwords were found. It was also stated that Amadeus has already completed the required security measures, and that as of the date of the announcement, no evidence of misuse of the information that was exposed was found. According to the company, the incident is not expected to affect flight operations.
Following the incident, Japan Airlines intends to contact relevant customers directly and take further measures, including warnings about suspicious emails, phone calls, and links to fake websites impersonating JAL Group websites.
The incident highlights the risk of exposing personal information to third-party technology providers, even when payment details are not disclosed. A combination of name, itinerary, flight date and contact details can be used by malicious actors to create messages and calls that appear to be trustworthy, with the aim of deceiving passengers into providing additional information.
Passengers who flew with the company during the relevant period are advised to watch for unexpected messages about their reservations, not to provide passport or payment details after a suspicious request, and to log into the company's account or website using an official address only.