JAL and JTA Say About 92,000 Reservations Accessed in Unauthorized Breach of Amadeus System

JAL and JTA received a report of unauthorized access from Amadeus on October 23 and, after investigating, made the matter public on October 28. The records showing signs of being viewed total about 92,000 and include reservation number, name, travel date, travel segment, and travel class. Of those, about 2,000 records additionally had email address, phone number, passport number, nationality, mileage number, flight number, ticket number, and seat number also viewed. The period in which records show signs of being viewed spans roughly three years from August 10, 2023 to September 23, 2026.

The leak route was not their in-house systems but unauthorized access to the cloud-based passenger management system of global reservation-system provider Amadeus. In South Korea, Korean Air and Asiana Airlines have also announced information leaks via the same Amadeus system, creating a situation in which the airline industry as a whole is aware of supply-chain risk to a common platform. Amadeus says it has completed necessary security measures, but details of the intrusion route have not been disclosed.

Credit card numbers and passwords were not included, and no improper use of the information has been confirmed. The two carriers opened a dedicated inquiry line on October 29 (weekdays 10:00–17:00, domestic 0120-25-6050). They warned customers to watch for phishing emails impersonating official notices and to avoid opening links in suspicious messages.

Passport numbers and travel histories can be repurposed for identity verification and could be used for travel-related fraud or impersonation. Customers who used JAL or JTA since August 2023 and registered a mileage number or passport number in their reservation are asked to check the original announcement and the contact information provided.