Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records
Severity: medium · Patch status: no-fix-needed · Since 2026-10-28
Japan Airlines disclosed that Amadeus IT Group, which operates its flight reservation, ticketing and check-in systems, suffered a breach exposing reservation data for 92,000 JAL and Japan Transocean Air customers, including names, reservation codes and flight information. For about 2,000 customers, passport numbers, frequent flyer numbers, email addresses and phone numbers were stolen. Flight operations were unaffected and credit card numbers were not compromised. The breach is part of a wave of attacks on Japanese firms (Sony Network Communications ISP, Burger King Japan, Capcom), prompting emergency measures from PM Takaichi's government. JAL will contact affected customers individually with anti-phishing guidance; no fix applies beyond Amadeus's own response.
What to do
- Monitor for phishing and social engineering targeting customers using stolen reservation and passport data
- Review third-party/IT-provider access to customer reservation data and enforce least privilege
- Notify affected customers per regulatory requirements and warn against impersonation scams
- Verify Amadeus's containment status and contractual incident-response obligations
Sources
All live incidents on Threat Watch
