Japan Airlines discloses breach of Amadeus Passenger Service System exposing 92,000 passengers
Japan Airlines (JAL) disclosed that a breach of Amadeus's Passenger Service System exposed data belonging to roughly 92,000 customers of JAL and Japan Transocean Air. Amadeus notified the airline on October 23, 2026, stating unauthorized access to its systems spanned August 10, 2023 to September 23, 2026 — a period of more than three years. About 90,000 customers had PNR reservation codes, names, flight dates, routes and travel classes exposed, while 2,000 additional customers also had email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight/ticket/seat numbers compromised. JAL says credit card numbers and passwords were not affected and flight operations are unaffected. The incident appears part of a broader campaign: All Nippon Airways (ANA), Asiana Airlines and Korean Air have also confirmed impact tied to the Amadeus flaw.
Entenda a falha
A vulnerabilidade
Amadeus disclosed an unspecified vulnerability in the travel booking display environment of its Passenger Service System (PSS), which could expose traveler data. The articles give no CVE, no affected or fixed versions, and no details on what an attacker needs. According to JAL, unauthorized access ran from August 10, 2023 to September 23, 2026. Exposed data includes PNRs, names, flight dates, routes and travel classes, and for about 2,000 JAL customers also email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers and flight, ticket and seat numbers. Amadeus says it has implemented security measures.
Como funciona
The articles do not describe the technical mechanism. They say only that the flaw sits in the booking display environment, the part of the PSS that shows reservation data, and that it let unauthorized parties reach traveler records held by Amadeus on behalf of airlines. The step at which it fails is not stated.
Por que é vulnerável
The root cause has not been published. The articles do not say whether it was a missing check, a logic error or something else, nor what the fix changes beyond Amadeus saying it implemented the necessary security measures. The unauthorized access lasted more than three years before it was found, so the flaw went unnoticed for a long time, but the articles do not explain why.
Como foi descoberta
Amadeus published a statement on October 1, 2026 saying it had discovered a vulnerability in its travel booking display environment. It said at the time that ransomware actors had not exploited it and that no payment data was exposed. On October 23, 2026 Amadeus told JAL that unauthorized access had occurred, and JAL disclosed this on its own site. BleepingComputer concludes the flaw appears to have been exploited maliciously. ANA, Asiana Airlines and Korean Air have also confirmed impact. Amadeus has not answered questions about the scope or about other affected airlines and markets. The articles do not say who found the flaw or how.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 21:16.
Detalhes técnicos
Amadeus published a statement on October 1, 2026 disclosing a vulnerability in its travel booking display environment that could expose traveler data, claiming at the time that ransomware actors had not exploited it and that no payment data was exposed. JAL's disclosure indicates the flaw was in fact maliciously exploited. Amadeus serves over 400 airlines, 210 airport operators, 34 cruise/ferry lines and 2 million hotels, making this a significant supply chain exposure for global aviation. Separately, ANA suspended certain website and mobile app services since October 21, an action reportedly linked to the PHP2Shell threat rather than the Amadeus incident.
Remediação
Amadeus has implemented security measures to address the flaw. Affected travelers should be alert to targeted phishing using PNR and itinerary details, and airlines relying on Amadeus PSS should seek scope confirmation and review access logs for the Aug 2023–Sep 2026 window.
Linha do tempo
-
Japan Airlines discloses breach of Amadeus Passenger Service System exposing 92,000 passengers
ler a análise desta fonte ocultar
Japan Airlines (JAL) disclosed that a breach of Amadeus's Passenger Service System exposed data belonging to roughly 92,000 customers of JAL and Japan Transocean Air. Amadeus notified the airline on October 23, 2026, stating unauthorized access to its systems spanned August 10, 2023 to September 23, 2026 — a period of more than three years. About 90,000 customers had PNR reservation codes, names, flight dates, routes and travel classes exposed, while 2,000 additional customers also had email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight/ticket/seat numbers compromised. JAL says credit card numbers and passwords were not affected and flight operations are unaffected. The incident appears part of a broader campaign: All Nippon Airways (ANA), Asiana Airlines and Korean Air have also confirmed impact tied to the Amadeus flaw.
Technical Details
Amadeus published a statement on October 1, 2026 disclosing a vulnerability in its travel booking display environment that could expose traveler data, claiming at the time that ransomware actors had not exploited it and that no payment data was exposed. JAL's disclosure indicates the flaw was in fact maliciously exploited. Amadeus serves over 400 airlines, 210 airport operators, 34 cruise/ferry lines and 2 million hotels, making this a significant supply chain exposure for global aviation. Separately, ANA suspended certain website and mobile app services since October 21, an action reportedly linked to the PHP2Shell threat rather than the Amadeus incident.
Remediation
Amadeus has implemented security measures to address the flaw. Affected travelers should be alert to targeted phishing using PNR and itinerary details, and airlines relying on Amadeus PSS should seek scope confirmation and review access logs for the Aug 2023–Sep 2026 window.