October 23–28, 2026: Japan Airlines disclosed on October 28 that hackers accessed customer reservation data held by Amadeus IT Group, the company that runs JAL’s passenger reservation systems. About 92,000 customers across JAL and Japan Transocean Air are affected. For about 2,000 JAL customers, passport numbers and frequent-flyer numbers were also exposed. Canonical: japan-airlines-amadeus-pnr2026. Primary reporting: The Record.
A passenger name record (PNR) is the booking file an airline keeps for each reservation: the booking code, passenger names, flights, and seats. Amadeus runs the passenger service systems that many airlines use, so an intrusion in its environment can reach more than one carrier. This incident follows the Amadeus iHotelier breach in September, which affected hotel reservation systems.
What happened
- October 23: Amadeus told JAL that it had found traces of external access in parts of its passenger reservation environment. Amadeus said it had completed the necessary security measures.
- October 28: JAL published its notice and confirmed that hackers accessed a portion of the customer reservation data held by its provider.
Verified and unverified
- Verified (JAL notice, October 28): hackers accessed a portion of customer reservation data held by the provider. Flight operations, reservations and check-in were not affected.
- Stated by JAL: card numbers and account passwords were not in the affected dataset.
- Unverified: the attackers’ identity, the access method, and whether any of the data has been published or sold. Neither JAL nor Amadeus has said.
What data was exposed
- About 90,000 customers: booking reference (PNR) codes, names, flight dates, routes and cabin class.
- About 2,000 JAL customers: the same, plus email addresses, phone numbers, passport numbers and nationalities, frequent-flyer numbers, ticket and seat numbers, and airline and flight numbers.
Passport numbers are the most sensitive part of the dataset. On their own they are not enough for most fraud, but combined with a name, date of birth and flight details they can support convincing impersonation and phishing.
Why it matters
The breach sits in the vendor’s environment rather than in JAL’s own network. The travel industry has seen vendor-side reservation exposures before, including the 2021 SITA incident, which affected frequent-flyer data held by several airlines. A single provider serving many carriers means one intrusion can expose several brands at once. JAL’s February 2026 same-day baggage-delivery incident is a separate case, which JAL later attributed to an error by a contractor’s employee; see the JAL timeline.
What to do
- Check for a JAL notice through the official JAL website or app, not through a link in an email or text message.
- If your passport number was involved, watch for unexpected identity-verification or travel-document messages, and report suspicious contact to the authorities. Do not send passport photos to unsolicited contacts.
- Be careful with messages that quote your flight. Verify schedule changes and refund offers in the airline’s app.
- Use a unique password and two-factor authentication on your JAL Mileage Bank account. JAL says account passwords were not in the dataset, but password reuse is still the main risk.
Reference links
- The Record: Japan Airlines warns of data breach as country grapples with multiple cyber incidents
- Cypro: JAL data breach exposes 92,000 customer records
Sourcing note: the count and data fields come from JAL’s October 28 notice as reported by secondary outlets. The notice itself was not retrieved.