Japan Airlines: reservation data for about 92,000 customers may have been viewed at Amadeus, passport numbers for about 2,000 included
Japan Airlines and Japan Transocean Air said on October 28, 2026 that unauthorised access to Amadeus’s passenger service system left traces suggesting reservation data for about 92,000 customers may have been viewed, including contact details and passport numbers for about 2,000; credit card numbers and passwords were not compromised and flight operations were not affected.
What happened
Japan Airlines (JAL) and Japan Transocean Air (JTA) announced on October 28, 2026 that systems operated by their passenger service system provider, Amadeus IT Group, were subject to unauthorised access, and that evidence indicates some reservation information may have been viewed from outside. Amadeus, which runs the system the airlines use for reservations, ticketing and check-in, reported the traces of external access to the airlines on October 23. The airlines’ wording is careful: they describe traces suggesting records were viewed, not a confirmed theft of a database, and this report keeps that distinction.
Amadeus has already implemented the security measures the airlines describe as necessary, and the airlines say no unauthorised use of the information has been confirmed. The incident did not affect flight operations. The same provider incident reached other airlines first: Korean Air and Asiana Airlines announced on October 23 that reservation information, confirmed so far as reservation numbers, had leaked through Amadeus’s system, with other data categories still under investigation there. JAL and JTA’s notice is the first in this incident to put a customer count and a detailed data list on the record.
Who is affected
About 92,000 customers with reservation records for flights carrying JL or NU flight numbers. The records are those that existed in Amadeus’s systems between August 10, 2023 and September 23, 2026 — that period describes the records in the system, not the dates customers booked or travelled. For approximately 90,000 customers, the information that may have been accessed is reservation numbers, names, travel dates, flight sectors and travel classes. For a further approximately 2,000 customers, the records may also have included contact details, passport numbers, nationalities, mileage membership numbers, airlines, flight numbers, ticket numbers and seat information.
Credit card numbers and passwords were not compromised, the airlines say. JAL and JTA say they will contact affected customers individually, so a direct notification from the airline group is the reliable signal that a particular customer’s record was involved.
How serious
The concrete risk is impersonation built on real travel details. A reservation number together with a name and a genuine flight date, route and seat gives a scammer a convincing script: a fake rebooking, refund or check-in message that quotes a traveller’s actual itinerary, or a call impersonating the airline about a real flight. Contact details in the smaller group — email addresses and phone numbers for about 2,000 customers — give that phishing somewhere to land, and passport numbers are a durable identity document detail that cannot be changed like a password, which raises the identity-fraud stakes for that group. Set against that: viewing is potential rather than confirmed for individual records on the airlines’ own wording, no misuse has been confirmed, and no payment card data or account passwords were involved, so this incident does not by itself open a customer’s JAL account or charge a card.
What to do now
If JAL or JTA contacts you, follow its guidance — and verify any message about this incident independently before acting on it. The airlines say their warnings to customers will cover suspicious emails and phone calls impersonating the JAL Group and redirects to fraudulent websites; a genuine-looking message that cites your real flight is exactly the lure to expect, so reach the airline through its official site, app or published phone numbers, never through a link or number supplied by the message itself.
For the approximately 2,000 customers whose passport numbers may have been involved, keep the notification the airline sends and watch for identity misuse that quotes your passport details. The airlines’ notice lists a dedicated inquiry desk opening October 29, 10 a.m.–5 p.m. Japan time on weekdays excluding Japanese national holidays, with an overseas number of +81-3-4332-7280 — confirm the current details on the airline’s official notice before calling.
Sources: TRAICY Global, October 28, 2026, reporting JAL and JTA’s announcement · iSec News, October 28, 2026, reporting Japan Airlines’ disclosure · Reuters, October 28, 2026, via Europe Says