Japan Airlines and Japan Transocean Air: break-in at supplier Amadeus's passenger service system; booking data of about 92,000 people was viewed

1. 2026-10-23

   Amadeus IT Group of Spain, which runs the passenger service system for both airlines, reported that a break-in at its system had left signs that some booking data was viewed from outside. [1]

2. 2026-10-28

   The two airlines disclosed it jointly. Amadeus said it had already finished the necessary security work. [1] [2]

The data are part of the booking records for the two airlines' flights held on the system between 10 August 2023 and 23 September 2026, about 92,000 people in all. [1] [2]

• About 90,000 people: booking number, name, flight date, route and class. [1]
• About 2,000 people: the above plus passport number, nationality, email address, phone number, mileage number, ticket number, seat number and more. [1]

No card numbers or passwords leaked. No misuse had been found at the time of disclosure, and flights were not affected. [1]

The airlines will contact each affected customer and warn about emails, calls and fake sites posing as the JAL Group. A dedicated help line opens on 2026-10-29. [1]

JAL moved its domestic and international systems to Amadeus's Altéa in 2017. All Nippon Airways (ANA), which uses the same system, said it was checking whether it was affected. [3]