Japan Airlines says a breach at booking provider Amadeus exposed data of about 92,000 customers
Passport numbers and contact details were exposed for around 2,000 of them, though JAL says card numbers and passwords were not affected.
Japan Airlines reports that a breach at Amadeus, the reservations technology provider, exposed records for about 92,000 customers, with the unauthorized access running from August 10, 2023 to September 23, 2026. For roughly 90,000 people, the intruder reached booking references, names, flight dates, routes and cabin classes. About 2,000 further customers had those fields exposed along with email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers and ticket and seat details. JAL says card numbers and passwords were not affected and it knows of no misuse so far. Amadeus had earlier disclosed a flaw in its travel booking display environment, and the airline says that flaw now looks to have been used maliciously. Local media report that ANA has also disclosed a customer data breach tied to Amadeus, and Asiana Airlines and Korean Air have confirmed impact, while Amadeus has not yet said how many airlines or markets are affected.
Why it matters
Customers of airlines that rely on Amadeus for reservations are the people most directly affected, since the intrusion ran for more than three years before it was stopped. The exposed fields, including passport and frequent flyer numbers, are the kind that can support identity fraud or targeted phishing, so affected travellers have reason to watch for unexpected contact. The breach also shows that a flaw in a third-party booking system can expose data held by several carriers at once, which is why the number of affected airlines and markets is still unclear.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.