Amadeus Breach Exposes Reservation Data of 92,000 Japan Airlines Group Customers

Japan Airlines (JAL) reported that attackers accessed approximately 92,000 customers’ reservation records through a breach at Amadeus IT Group, the provider of its reservation, ticketing and check-in systems. The exposed records covered JAL and Japan Transocean Air flights booked between August 10, 2023, and September 23, 2024, and included names, reservation codes and flight information. Approximately 2,000 JAL customers also potentially had passport numbers, frequent flyer numbers, email addresses and phone numbers exposed. JAL said flight operations were unaffected and credit card numbers were not compromised.

JAL plans to notify affected customers individually and warn them about phishing and impersonation risks arising from the stolen information. The incident highlights exposure through critical third-party service providers and follows several other breaches affecting Japanese companies. Prime Minister Sanae Takaichi has pledged emergency cybersecurity measures, while Japanese and U.S. defense leaders have discussed stronger cooperation against malicious cyberactivity.