Summary
Japan Airlines (JAL) disclosed on October 28, 2026 that hackers accessed customer reservation data held by its reservation provider, Amadeus IT Group. Amadeus runs JAL's flight reservation, ticketing and check-in systems and told the airline that a portion of reservation data for JAL and Japan Transocean Air flights was accessed.
What Was Exposed
| Group | Data |
|---|---|
| About 92,000 customers | Names, reservation codes, flight information |
| About 2,000 JAL customers | Also passport numbers, frequent flyer numbers, email addresses, phone numbers |
JAL says flight operations were not affected and credit card numbers were not compromised.
Wider Context in Japan
The disclosure comes as Japan deals with a run of cyber incidents, according to The Record:
- Sony Network Communications: more than 2.5 million people had information stolen in a breach earlier in October.
- Burger King Japan: about 11 million customer records exposed.
- Capcom: about 11.7 million people affected.
- An online financial services firm offered compensation to customers who lost money after an attack on its foreign exchange trading service.
Prime Minister Sanae Takaichi held a cabinet meeting on the attacks and promised emergency measures to better protect companies and citizens.
Why It Matters
The breach sits at a vendor, not at the airline itself, which is a recurring pattern: one provider holds data for many carriers. Passport numbers combined with names, flight details and contact information are well suited to targeted phishing and identity fraud, for example messages that quote a real reservation code.
Recommendations
For affected travelers
- Treat unsolicited messages that reference a booking or reservation code with suspicion, and go to the airline's site directly.
- Watch for requests to "verify" passport details or frequent flyer accounts, and change frequent flyer account passwords.
- Consider whether passport replacement or monitoring is warranted if the passport number was exposed.
For organizations
- Inventory vendors that hold customer identity documents and confirm breach-notification terms.
- Minimize the passport and identity data shared with downstream providers where possible.