A breach at a third party exposed data on about 92,000 Japan Airlines passengers

Japan Airlines says a breach at its technology vendor Amadeus exposed reservation data on about 92,000 customers of JAL and its group carrier Japan Transocean Air. For roughly 90,000 of them, the fields involved were a booking reference, a name, a flight date, a route and a cabin class. About 2,000 people had more viewed, including passport numbers.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The intrusion was not on JAL’s own network. Amadeus IT Group, the Spanish company that runs the airline’s passenger service system, told JAL on October 23 that traces showed part of its customer reservation data had been accessed externally. JAL went public with the details on October 28, and says no credit card numbers or passwords were involved and flight operations were not affected.

Two tiers of exposed passenger data

JAL’s customer notice separates the 92,000 into two groups. For about 90,000 people, the accessed items were the reservation code, name, flight date, flight sector and class of service. For about 2,000, the list is much longer: email address, phone number, passport number, nationality, frequent flyer number, airline name, flight number, ticket number and seat number.

A passenger service system is the core record-keeping platform of an airline, holding reservations, ticketing and check-in data, which is why a vendor-side intrusion can reach data about travelers on more than one carrier. JAL says it has found no current evidence that the information has been misused, and it stresses that credit card numbers and passwords were not compromised, so payment data was not part of what the intruders reached. The company has not said how the unauthorized access happened on the vendor side.

Amadeus and the August 2023 to September 2026 window

According to Aviation Wire, the affected records belong to customers with JAL or Japan Transocean Air bookings stored in the Amadeus system between August 10, 2023 and September 23, 2026. That span describes how long the data sat in the system, not when the bookings were made or flown, and JAL has not disclosed when the intrusion itself took place. JAL moved to the Amadeus passenger service system in November 2017, Aviation Wire notes. JAL’s notice is the main account of the vendor’s response: Amadeus has completed the necessary security measures.

Korean Air disclosed a related-looking incident days earlier. A Money Today report says Amadeus notified the airline at 10:44 p.m. on October 20, and that Korean Air described unauthorized access using login credentials assigned to an account in the Amadeus system. Reservation numbers were the only confirmed leaked data at that point, with other items still being checked, and the airline saw no sign of intrusion into its own database. The estimated window cited there is also August 2023 to September 2026. Neither airline says whether one intrusion explains both disclosures.

What JAL asks affected customers to watch for

JAL has contacted affected customers individually, using the email addresses given at booking, and warns them about phishing emails, fraudulent calls and fake websites impersonating the JAL Group. An inquiry desk operates Monday to Friday from 10:00 to 17:00 Japan time, excluding weekends and national holidays. Callers within Japan can use 0120-25-6050 or 03-4332-7280, and callers from overseas can use +81-3-4332-7280.

Passport numbers and phone numbers are the sort of details that make an impersonation call or message sound plausible, which explains why the warning is aimed first at the roughly 2,000 people with the longer list of fields. People in the larger group of about 90,000 hold less sensitive information, though a booking reference paired with a name, a flight date and a route can still be used to make a fake rebooking or refund message look authentic. JAL says it will remind customers of exactly this phishing risk when it contacts them.

A wave of Japanese breaches around the same weeks

Jonathan Greig of Recorded Future News, writing for The Record, places the JAL disclosure inside a run of Japanese incidents: Sony Network Communications with more than 2.5 million people, Burger King Japan with 11 million and Capcom with 11.7 million. Prime Minister Sanae Takaichi called the situation serious and promised emergency cybersecurity measures, according to that account. The Record also cites a Japan Times report that Defense Minister Shinjiro Koizumi discussed the cyberattacks with U.S. Defense Secretary Pete Hegseth in the Philippines, which shows how far the string of incidents has travelled into government.

BleepingComputer also covered the JAL incident as a third-party breach, a description that fits JAL’s notice, which names Amadeus rather than any JAL system as the point of access: the data came out of a vendor’s system, and the airline learned of it from that vendor a week before telling customers.

The unanswered question is timing. JAL has not said when intruders got into the Amadeus system, so the August 2023 to September 2026 storage window is the only boundary available, and the vendor’s own account of how far the access reached is not in JAL’s notice.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.