2026 Japan Airlines — hackers accessed reservation data held by passenger-system vendor Amadeus; ~92,000 customers (about 2,000 with passport numbers)
Data compromised
About 90,000 customers across JAL and Japan Transocean Air: booking reference (PNR) codes, names, flight dates, routes and cabin class. About 2,000 JAL customers: the same plus email addresses, phone numbers, passport numbers and nationalities, frequent-flyer numbers, ticket and seat numbers, and airline and flight numbers. JAL says flight operations, reservations and check-in were not affected, and that card numbers and account passwords were not in the dataset.
Technical writeup
Root cause
Access to parts of the passenger reservation environment run by Amadeus IT Group, JAL’s passenger-system provider. Amadeus told JAL on October 23 that it had found traces of external access, and JAL says Amadeus has completed its security measures. The attacker and method have not been identified publicly.