Amadeus System Breach Exposes Data of Thousands of JAL Passengers

A pile of hay sitting next to a forest filled with trees — Lucas Dalamarta / Unsplash

The personal information of approximately 92,000 passengers from JAL and Japan Transocean Air was exposed following a hacking incident involving the systems of Amadeus IT Group, a global aviation reservation system provider.

JAL announced on October 30 that unauthorized access occurred within the PSS of Amadeus, which handles ticket reservations, issuance, and boarding procedures. The airline was notified of the incident by Amadeus on October 23. Evidence shows that unauthorized external access took place over a period of approximately three years, from August 10, 2023, to September 23, 2026.

For about 90,000 affected passengers, the accessed data included reservation numbers, names, boarding dates, flight segments, and seat classes. An additional 2,000 passengers had more sensitive information exposed, including email addresses, phone numbers, passport numbers, nationalities, mileage membership numbers, flight numbers, ticket numbers, and seat numbers. JAL stated that passwords and credit card numbers were not leaked, and no cases of fraudulent use of personal information have been confirmed. Flight operations were not affected.

Other airlines also reported impacts from the same provider. ANA reported that information for approximately 37,800 passengers was affected, while Cathay Pacific reported unauthorized access to approximately 53,000 reservation records.

In South Korea, Korean Air and Asiana Airlines were notified by Amadeus of the unauthorized access on October 20, with Korean Air receiving the notice at 10:44 PM and Asiana Airlines at 10:49 PM. Both airlines provided guidance to customers on October 23. While they confirmed that there was no evidence of direct breaches to their own internal databases, the exact scale of the data impact for these two carriers has not been disclosed.

According to notices from Korean Air and Asiana Airlines, the attacker gained unauthorized access by using login authentication information assigned to Amadeus system accounts.