Amadeus breach: Japan Airlines says data of 92,000 customers exposed

Japan Airlines (JAL) has disclosed that unauthorised access to the Amadeus Passenger Service System, the reservation software it uses from the European travel technology company Amadeus, exposed the data of about 92,000 customers. JAL said Amadeus told it of the breach on October 23, 2026, and that outsiders had been able to read reservation records since August 2023. On October 29, All Nippon Airways (ANA) also announced a customer data breach linked to Amadeus, according to Japanese media, and South Korea's Asiana Airlines and Korean Air have said they were affected too.

Most travellers never deal with Amadeus directly, but much of the world's airline industry runs on systems like it. A passenger service system is the back-office software that stores every booking: who is flying, on which flight, with what contact details and, for international trips, passport information. Airlines rent this software from a few large providers rather than building their own. That makes those providers a single point of weakness. A flaw or stolen login in one provider's system can expose passengers of many airlines at once, which is what this case appears to show, with carriers in Japan and South Korea reporting impact within days of each other.

The length of the exposure is also notable. If, as JAL has said, outsiders could read records from August 2023, the problem went unnoticed for about three years. Reports differ on the cause. One account says the intruders used login credentials assigned to accounts on the system, which would mean stolen or misused passwords rather than a software bug; another report says a flaw existed but had not been exploited and that no payment data was exposed. Amadeus has not given a full public explanation, so the cause should be treated as unconfirmed.

For a start-up and technology audience, the episode is a reminder of supply-chain risk, the danger that comes not from your own systems but from a supplier's. Companies of every size depend on outside software for payments, customer records and bookings, and regulators increasingly hold the company that collects the data responsible even when the breach happens at a vendor. India's Digital Personal Data Protection Act places that duty on the company that decides how personal data is used, and requires it to inform the Data Protection Board and affected people of a breach.

What travellers should do: anyone who has flown with the affected airlines should watch for emails, calls or messages that quote real booking details, since attackers often use such details to make phishing (fake messages designed to steal passwords or money) look genuine. Do not click links in unexpected messages about refunds or rebooking; go to the airline's official website or app instead. Change the password on frequent flyer accounts, and do not reuse it elsewhere. Those whose passport numbers may have been exposed should be alert to identity fraud attempts.

Short-term: Affected airlines are notifying customers, and more carriers may disclose that they were hit as Amadeus completes its review. Passengers face a higher risk of targeted phishing.

Long-term: Airlines and regulators are likely to look harder at how reservation providers control access, and at how long a breach can go undetected. The case adds to pressure for stricter oversight of shared software suppliers.

Who is affected: Customers of Japan Airlines, Japan Transocean Air, ANA, Asiana Airlines and Korean Air, including foreign travellers who booked with them; the airlines; and other companies that rely on the same reservation software.

Questions and Answers