Japan Airlines Passenger Data Exposed in Security Breach

Japan Airlines (JAL) has confirmed that the personal data of its customers has been compromised. The incident is linked to the Amadeus Passenger Service System, which the airline uses for bookings, ticketing, and check-in processes. In total, approximately 92,000 passengers have been affected.

Incident Details and Scale

Amadeus notified the airline of the security breach on 23 October 2026. Investigations revealed that unauthorized access to the system occurred over a prolonged period, spanning from 10 August 2023 to 23 September 2026. For approximately 90,000 customers, attackers gained access to booking codes (PNR), names, flight dates, routes, and travel classes. The situation is more severe for an additional 2,000 passengers, whose passport numbers, email addresses, phone numbers, citizenship details, loyalty program numbers, and detailed flight information were exposed. The airline stated that credit card details and passwords remain secure and were not leaked. Furthermore, there is currently no evidence that the stolen information has been misused.

Global Impact and Amadeus' Responsibility

Amadeus is a technology giant serving hundreds of airlines, airports, hotels, and travel agencies worldwide. The vulnerability, which the company discovered in early October, relates to the display environment of its passenger booking system. Beyond Japan Airlines, the incident affected other major carriers, including All Nippon Airways (ANA), Asiana Airlines, and Korean Air. Amadeus representatives state that necessary security measures have been implemented and that flight schedules are not at risk. However, the fact that the system failed to detect the intrusion for three years highlights the modern challenges of cybersecurity. For frequent international travelers, this incident serves as a reminder that the security of personal information depends not only on the reliability of the airline but also on the technological chain they employ. To mitigate similar risks in the future, the industry is expected to implement stricter data protection protocols and monitoring systems.