INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Japan Airlines Experiences Data Breach Exposing Passenger Information

| 2026-10-29 22:08 CRITICAL LOW DATA BREACH SUPPLY CHAIN CRITICAL INFRASTRUCTURE & OT
JSON
Executive Summary
AI-generated
On October 29, 2026, Japan Airlines suffered a data breach at Amadeus's Passenger Service System, exposing the personal information of approximately 92,000 customers. The attack was attributed to malicious exploitation of a vulnerability in Amadeus's travel booking display environment, which exposed reservation codes, names, flight dates, routes, and travel classes for about 90,000 customers. Additionally, email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers were also compromised for an additional 2,000 customers. The breach occurred between August 10, 2023, and September 23, 2026, with Japan Airlines confirming that credit card numbers and passwords were not affected. Amadeus has since implemented security measures to prevent further exploitation, and flight operations remain unaffected; however, the incident highlights a broader vulnerability in the travel industry's systems.
Technical Mitigations AI-generated
• Detect and block malicious PHP code using a web application firewall (WAF) to prevent exploitation of the Amadeus vulnerability. • Implement secure coding practices, such as input validation and sanitization, to prevent similar vulnerabilities in travel booking display environments. • Regularly monitor system logs for signs of unauthorized access or suspicious activity related to the exploited PHP2Shell threat.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
KR JP
aviationaviation hospitalityhospitality
Incident Timeline
‎August 10, 2023
Threat actors exploited a third-party vendor's vulnerability to gain unauthorized access to Japan Airlines' passenger data.
industry Aviation
General Document Context
industry Hospitality
General Document Context
‎between August 10, 2023
Threat actors used unauthorized access to exploit Amadeus systems between August 10, 2023, and September 23, 2026.
‎September 23, 2026
Threat actors accessed reservation codes, names, flight dates, routes, and travel classes for approximately 90,000 customers through unauthorized access to Amadeus systems between August 10, 2023, and September 23, 2026.
industry Aviation
General Document Context
industry Hospitality
General Document Context
organisation Amadeus
The company said Amadeus has now implemented the necessary security measures and flight operations are unaffected.
victims 90,000 customers
As a result of this lengthy breach, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers.
victims 2,000 additional customers
An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.
‎October 1, 2026
Amadeus discovered a vulnerability in its travel booking display environment that could expose travelers' data.
industry Aviation
General Document Context
industry Hospitality
General Document Context
organisation Asiana Airlines
Other airlines that have confirmed impact from the Amadeus flaw are Asiana Airlines and Korean Air , both major South Korean carriers.
organisation Korean Air
Other airlines that have confirmed impact from the Amadeus flaw are Asiana Airlines and Korean Air , both major South Korean carriers.
organisation BleepingComputer
BleepingComputer has asked Amadeus for more information about the scope of the impact, specifically whether more airlines and other countries/markets were affected, but the company has not provided more information as of publication.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎October 21
Japan Airlines suspended certain related services on its website and mobile app starting October 21.
‎October 23, 2026
Amadeus notified Japan Airlines of a data breach between August 10, 2023, and September 23, 2026.
industry Aviation
General Document Context
industry Hospitality
General Document Context
‎2026/10/29
All Nippon Airways experienced a customer data breach tied to Amadeus, exposing passenger information.
tactic Data Breach
All Nippon Airways (ANA) has also announced a customer data breach earlier today tied to Amadeus, according to local media .
organisation All Nippon Airways
All Nippon Airways (ANA) has also announced a customer data breach earlier today tied to Amadeus, according to local media .
‎2026/10/29
Threat actors used Amadeus's Passenger Service System to expose the data of approximately 92,000 customers.
organisation Japan Airlines
Japan Airlines suffers third-party data breach exposing passenger info.
organisation JAL
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
organisation Amadeus’s Passenger Service System
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
organisation JAL Group
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
organisation Japan Transocean Air
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
victims 92,000 customers
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
Tactical Metrics
Metrics
victims
92,000
Customers
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in.
Metrics
victims
90,000
Customers
As a result of this lengthy breach, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers.
Metrics
victims
2,000
Additional Customers
An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.
Intelligence Sources
BleepingComputer 2026-10-29