Japan Airlines said on October 28, 2026, that hackers accessed reservation data affecting approximately 92,000 customers of the airline and its subsidiary Japan Transocean Air. The data breach involved the reservation environment of Amadeus IT Group, the airline's technology provider, rather than its own systems.
Amadeus notified the two airlines on October 23, five days before the public disclosure. Flight operations were not affected. JAL also said it had found no evidence that anyone misused the information.
The exposure covered two groups of records, with a wider range of personal details possible for about 2,000 customers. JAL said it would contact affected customers individually. The inquiry line opened on October 29, 2026 (JST).
The incident did not interrupt flights. JAL's notice describes a customer-information exposure, not an operational disruption.
Most records held booking details, while about 2,000 included more sensitive data
| Affected records | Information that may have been accessible |
|---|---|
| Approximately 90,000 customers | Passenger names, booking reference codes, flight dates, routes or flight sectors, and class of service |
| About 2,000 customers | Email addresses, telephone numbers, passport numbers, nationalities, frequent-flyer membership numbers, airline and flight numbers, ticket numbers, and seat numbers |
JAL said credit card numbers and account passwords were not part of the affected dataset. The additional fields varied by reservation. Not every record in the smaller group necessarily contained every listed detail.
JAL is contacting affected customers and warning about impersonation
The airline said it would provide individual assistance and alert customers to suspicious contact posing as the JAL Group. Its notice specifically flags phishing and impersonation.
- JAL said it would contact affected customers individually.
- The airline urged vigilance around phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group.
- JAL's dedicated inquiry desk opened its customer line on October 29, 2026 (JST).
“We will contact the affected customers individually to provide necessary assistance, including reminders to remain vigilant against phishing emails, fraudulent phone calls, and suspicious websites impersonating the JAL Group.”
The affected reservation records span a period of more than three years
Traces of external access in the provider's environment were identified across a period beginning August 10, 2023, and ending September 23, 2026. Those dates describe the span in which affected records were present and accessible in the Amadeus Passenger Service System. They do not establish when individual passengers booked or traveled. Nor do they show that an attacker maintained uninterrupted access throughout the period.
The affected reservations were for flights with JL or NU flight numbers that existed in the system during that span. JAL moved its reservation operation to the Amadeus platform in 2017.
Amadeus traced the intrusion to a system account's valid credentials
Attackers entered the cloud-based environment using valid login credentials for an Amadeus system account. The disclosures do not identify a particular software flaw as the entry point. They also name no specific software version.
Amadeus applied security patches and other countermeasures to block further unauthorized access. The provider had also notified Korean Air and Asiana Airlines on October 20, 2026. Notices from those carriers described unauthorized use of credentials linked to an Amadeus system account.
JAL has not stated whether it will offer identity protection to the roughly 2,000 customers whose records may have included passport numbers. That question remains distinct from the airline's stated plan to contact affected customers and provide assistance.
Japan's leaders have pledged wider cyber defenses
Prime Minister Sanae Takaichi convened a cabinet meeting on October 26, 2026, focused on recent cyberattacks and pledged emergency measures to protect Japanese companies and citizens. She cited concern about damage caused by misuse of leaked personal information.
“The situation is serious, with growing concerns about civil damages resulting from the misuse of leaked information. We must urgently strengthen our countermeasures.”
Defense Minister Shinjiro Koizumi met U.S. Defense Secretary Pete Hegseth in the Philippines on October 28, 2026. The Japanese Defense Ministry said the two officials agreed to keep strengthening cooperation against malicious cyberactivity, including large-scale personal-information leaks.
“Against the backdrop of a series of malicious cyberactivities — including large-scale leaks of personal information — both domestically and internationally, the two defense chiefs agreed to continue strengthening cooperation and coordination to prevent such activities from having a serious impact on the lives of citizens, economic activities, and, ultimately, the security of both nations.”
