Key takeaways

  • Japan Airlines (JAL) and its subsidiary Japan Transocean Air (JTA) say booking records of about 92,000 passengers were viewed through unauthorized access to Amadeus, the Spanish company whose passenger service system handles their reservations, ticketing and check-in.
  • For about 2,000 of them, the records included passport numbers, nationality, email addresses, phone numbers and frequent flyer numbers. For the rest, booking numbers, names, flight dates, routes and cabin class. No card numbers or passwords were involved.
  • JAL says the traces of viewing run from August 10, 2023 to September 23, 2026: up to three years.
  • ANA, Korean Air and Asiana have also disclosed unauthorized access through Amadeus. Asiana says it was caused by login credentials assigned to an account in Amadeus's system, and that its own systems were not breached.
  • In our view, it is the clearest case yet of this month's theme: a vendor that runs a core system for many companies becomes a single point through which all of them are exposed, and none of them can see it from their side.

What happened#

Airline Told by Amadeus Disclosed What it says
Korean Air, Asiana October 20 (22:49 KST, per Asiana) October 23 Booking reference numbers of some customers leaked; other items being confirmed. Unauthorized access used login credentials assigned to an account in Amadeus's system. Estimated to have happened between August 2023 and September 2026. Own databases not breached. (From Asiana's notice; Korean Air's notice, as summarized by piyolog, gives the same account)
JAL, JTA October 23 October 28 About 92,000 passengers' booking records viewed, about 2,000 with passport numbers and contact details. Traces from August 10, 2023 to September 23, 2026
ANA Not stated October 29 Traces that some customers' personal information in ANA flight bookings was viewed. Numbers, items and period not yet disclosed, according to ITmedia

Amadeus has not published a statement on the airline case that we could find. According to JAL and Asiana, it has blocked the unauthorized access, completed the necessary security measures, and started monitoring the dark web.

What JAL lists#

Passengers Data with traces of viewing
About 90,000 Booking number, name, flight date, route, cabin class
About 2,000 All of the above, plus email address, phone number, passport number, nationality, frequent flyer number, airline, flight number, ticket number, seat number and other details

JAL says no card numbers or passwords leaked, no misuse has been confirmed and flights are not affected. It will contact the passengers concerned and has opened a dedicated phone line.

ANA has just moved more of its flights onto Amadeus#

ANA has used Amadeus for international flights since April 2015, and moved its domestic flights from its own system in May 2026, according to ITmedia. It has not said which bookings are affected.

Not the first Amadeus notice in Japan this autumn#

In September, LEGOLAND Japan said Amadeus, which runs the online booking platform of its hotel's official booking site, had reported unauthorized access to contact details in 1,557 bookings, according to ScanNetSecurity. Whether that is connected to the airline case is not known.

Why it matters#

A shared core system. A passenger service system is the heart of an airline's customer operations: every booking, ticket and check-in passes through it. A handful of vendors provide these systems to many of the world's airlines, and Amadeus is one of the largest. When an account inside such a vendor is misused, the airlines' own security does not come into play. Asiana's notice says as much: the incident "occurred in Amadeus's managed area".

Three years. JAL's window of August 2023 to September 2026 does not necessarily mean someone was looking for three years. It is the period in which traces of viewing were found. But it means that whatever access was used went unnoticed for a long time, and that the airlines learned of it only when Amadeus told them.

Credentials, again. The only cause given so far, by Asiana, is the misuse of login credentials for an account in Amadeus's system. It is the same pattern as in this month's email delivery breaches and the IDCF Cloud attack: the attackers did not break into the customers; they used access that already existed inside the vendor.

Different notices for the same incident. Korean Air and Asiana were told on October 20 and disclosed on October 23. JAL was told on October 23 and disclosed on October 28. ANA disclosed on October 29 without numbers. Passengers who fly several of these airlines may receive different information at different times.

Our view#

Airlines cannot see into the system that holds their customers. In our view, the lesson for any company that outsources a core system is to agree, before an incident, on what the vendor will log, how long it keeps those logs, how quickly it will notify, and what evidence it will hand over. JAL and ANA can only report what Amadeus tells them, and the size of the gap between the two airlines' notices shows how much depends on the vendor.

Passport numbers change the risk. For most passengers, the data is booking details that are useful mainly for convincing phishing: a message that quotes your real flight and booking number is hard to dismiss. For the 2,000 whose passport numbers and contact details were viewed, the risk is higher. A passport number alone is not enough to travel on, but combined with a name, nationality and contact details it supports impersonation and targeted fraud.

Expect airline-themed phishing. Booking numbers and names are exactly what a fake "flight change" or "refund" message needs. JAL already warns of fake emails, calls and sites using its name.

What this means for readers#

  • If you flew or booked with JAL, JTA, ANA, Korean Air or Asiana in the past three years, be wary of messages about flight changes, refunds or compensation, even if they quote your real booking. Check bookings in the airline's own app or site.
  • If JAL tells you your passport number was viewed, watch for targeted messages and calls, and do not send copies of your passport in reply to any request you did not initiate.
  • If you run a core system through a vendor, ask now how it logs and monitors access by its own staff and accounts, how quickly it will tell you of unauthorized access, and what you will receive to report to the regulator.

Japanese terms at a glance#

Japanese Reading Meaning
旅客サービスシステム ryokaku sābisu shisutemu Passenger service system
予約記録 yoyaku kiroku Booking record
予約番号 yoyaku bangō Booking reference
委託先 itakusaki Contractor, vendor
不正アクセス fusei akusesu Unauthorized access
参照された形跡 sanshō sareta keiseki Traces of having been viewed
マイレージ番号 mairēji bangō Frequent flyer number