Japan Airlines Data Breach: 92,000 Passengers Affected

Japan Airlines has confirmed a major data security incident affecting approximately 92,000 passengers after unauthorized access to a reservation system operated by its technology provider, Amadeus. The airline disclosed the incident on October 28, 2026, warning that reservation details, passenger names, flight information, and, in some cases, passport numbers may have been accessed by an unauthorized party.

The incident affected reservation records associated with Japan Airlines (JAL) and Japan Transocean Air (JTA).

Quick answer: The Japan Airlines data breach exposed reservation details belonging to approximately 92,000 passengers. Around 2,000 of those individuals may also have had contact information, passport numbers, and frequent flyer details accessed. Japan Airlines confirmed that credit card numbers and account passwords were not compromised, and flight operations remain unaffected.

Although the airline has not identified evidence of customer information being misused, passengers should remain alert to phishing emails, fraudulent calls, and websites impersonating Japan Airlines.

Here is what happened and how travelers can protect themselves.

Japan Airlines Data Breach: What Happened?

On October 28, 2026, Japan Airlines and Japan Transocean Air issued a joint statement confirming that passenger reservation records had been accessed without authorization.

The incident originated from Amadeus IT Group, a technology company that provides passenger service systems to airlines around the world.

These systems process flight reservations, ticketing, and check-in information.

According to Japan Airlines’ official announcement, Amadeus notified the airlines about suspicious activity on October 23, 2026.

Investigators identified traces indicating that some customer reservation records had been accessed externally.

Key facts about the incident

The Japan Airlines data breach raises concerns because airline reservation systems contain information that can reveal passengers’ travel schedules and personal identities.

However, the airline emphasized that Amadeus had completed the necessary security measures and that no misuse of the affected information had been identified.

Was the breach active for three years?

The period from August 10, 2023, to September 23, 2026, refers to the timeframe associated with reservation records showing traces of external access.

This does not establish that hackers maintained continuous access to the system for more than three years.

The exact initial intrusion date and the complete technical attack sequence had not been publicly established.

What Personal Information Was Exposed?

The Japan Airlines data breach affected two groups of passengers, with different categories of information potentially exposed.

Approximately 90,000 passengers

For the larger group, the records included:

• Passenger name
• Passenger Name Record (PNR), also known as the booking reference
• Flight date
• Flight route
• Class of service

These records contain information that could be used to create convincing messages about a passenger’s travel plans.

For example, someone who knows a passenger’s name, flight date, and booking reference could attempt to impersonate airline customer support.

This is a potential phishing risk, not confirmation that attackers have already used the information in fraudulent communications.

Approximately 2,000 passengers

A smaller group may have had additional personal information accessed, including:

• Email address and phone number
• Passport number and nationality
• Frequent flyer number
• Airline name and flight number
• Ticket number and seat number

Passport information deserves particular attention because it can be used in identity-verification scams and impersonation attempts.

However, the disclosure of a passport number does not automatically mean a passport has been cloned or an identity has been stolen.

What information was not compromised?

Japan Airlines explicitly stated that credit card numbers and passwords were not exposed in the reported incident.

The airline also reported no confirmed misuse of the affected passenger information at the time of its announcement.

This distinction is important because a reservation-data exposure differs from a confirmed compromise of payment systems or account credentials.

How Did the Japan Airlines Data Breach Happen?

The Japan Airlines data breach involved unauthorized access to a third-party passenger service system operated by Amadeus.

Amadeus provides technology used to manage airline reservations, ticketing, and passenger check-in.

When airlines integrate these systems into their operations, customer information may be processed by external service providers.

Why third-party systems create security risks

Modern airlines depend on interconnected technologies to manage bookings, payments, check-in procedures, and customer communications.

These integrations improve operational efficiency but can also create additional security dependencies.

If an external technology provider experiences a security incident, data belonging to multiple business customers may be affected.

This type of exposure is commonly associated with third-party or supply-chain security risk.

However, the precise technical cause of the Amadeus incident had not been fully disclosed in Japan Airlines’ October 28 announcement.

Were other airlines affected?

Japan Airlines was not the only airline reporting concerns involving Amadeus systems.

On October 29, All Nippon Airways (ANA) disclosed indications of unauthorized access to reservation information through the same provider.

On October 30, ANA stated that approximately 37,800 customers were within the scope of its own incident notification.

Other airlines, including Korean Air and Asiana Airlines, had also reported reservation-data exposure concerns involving Amadeus.

These disclosures suggest a wider industry impact, although the extent of any shared technical cause should not be assumed without further investigation.

The Japan Airlines figure of approximately 92,000 passengers does not include ANA’s separately reported customer total.

Are Japan Airlines Passengers at Risk?

The primary concern following the Japan Airlines data breach is the possibility that exposed reservation information could be used to support fraudulent communications.

Even when passwords are not compromised, personal details can make phishing messages appear more convincing.

1. Fake flight confirmation emails

A scammer could send a message claiming that a passenger’s booking has changed or requires immediate confirmation.

The message might contain the passenger’s real name or flight information.

It could then direct the recipient to a fraudulent website designed to collect account credentials or payment information.

2. Fraudulent refund and compensation messages

Attackers may impersonate Japan Airlines and offer compensation for the security incident.

A fraudulent message could ask passengers to enter credit card information or pay a processing fee to receive a refund.

Japan Airlines has not instructed passengers to pay a fee to secure their information following this incident.

Users should not trust unsolicited compensation requests.

3. Fake customer support calls

A caller might claim to represent Japan Airlines and reference actual travel details.

The caller could request identity documents, account passwords, or one-time authentication codes.

Knowing a passenger’s reservation details does not prove that a caller is an authorized airline employee.

4. Identity-related scams

For passengers whose passport numbers and additional personal details were potentially accessed, there may be an elevated risk of impersonation attempts.

Travelers should watch for suspicious requests involving passport verification, visa processing, and identity confirmation.

There is no need to assume that identity theft has occurred solely because information was exposed. Travelers should assess their individual circumstances and follow guidance from the airline and relevant government authorities.

What Should Affected Japan Airlines Passengers Do?

If you believe your information may have been affected by the Japan Airlines data breach, follow these practical steps.

Step 1: Check Japan Airlines’ official announcement

Visit the official Japan Airlines website directly rather than opening unexpected links from emails or text messages.

JAL has said it will contact affected customers individually.

The airline also established a dedicated inquiry desk for questions about the incident.

Official contact details published by JAL:

• From Japan: 0120-25-6050 or 03-4332-7280
• From overseas: +81-3-4332-7280
• Hours: 10:00–17:00 Japan Standard Time, Monday through Friday, excluding Japanese national holidays

Verify these numbers against the latest official notice before calling.

Step 2: Watch for suspicious emails and calls

Be cautious of messages claiming that your flight has been canceled, your account needs urgent verification, or your passport must be uploaded again.

Japan Airlines has separately warned about phishing campaigns that impersonate its brand.

According to JAL’s phishing guidance, the airline does not request sensitive information such as passwords or credit card numbers through email.

Never provide authentication codes, passwords, or payment information to an unsolicited caller.

Step 3: Review your travel reservations

Use the official Japan Airlines website or application to review upcoming bookings.

Check for unexpected changes to flight details, passenger information, or contact preferences.

If something appears incorrect, contact the airline using a verified support channel.

Avoid posting your complete booking reference or ticket details on social media.

Step 4: Secure your airline and email accounts

Although Japan Airlines reported no password exposure, this is a useful opportunity to review account security.

Use unique passwords for airline accounts and the email address associated with travel reservations.

Where supported, enable an additional authentication method.

For broader recommendations, read our best account security practices.

Step 5: Protect your passport information

If your passport number may have been affected, monitor for suspicious requests involving identification documents.

Avoid providing passport scans to unknown websites or individuals.

If you discover evidence of identity misuse, contact the relevant passport-issuing authority and follow its instructions.

Replacing a passport is not automatically necessary for everyone affected by the disclosure.

Step 6: Report suspicious activity

If you receive a suspicious communication impersonating Japan Airlines, avoid interacting with its links or attachments.

Preserve relevant evidence and report the activity to the airline or appropriate authorities.

The US Federal Trade Commission’s travel scam guidance recommends independently verifying travel websites and contact information rather than relying on unexpected messages.

How to Protect Your Travel Accounts From Data Breaches

The Japan Airlines data breach highlights why travel security should extend beyond protecting a single airline account.

Travelers frequently share personal information with airlines, hotels, booking platforms, and travel agencies.

A practical security routine can reduce the consequences of future incidents.

Use unique passwords

Avoid using the same password for airline accounts, email services, and financial platforms.

If one service is compromised, reused credentials can place other accounts at risk.

A reputable password manager can help generate and store unique passwords.

Enable two-factor authentication

Two-factor authentication adds another layer of verification to supported accounts.

Even if attackers obtain a password, they may still need an additional factor to complete a login.

For services that support app-generated verification codes, learn how a two factor authentication app works.

Where supported, passkeys offer stronger resistance to phishing than manually entered one-time codes.

Important: Two-factor authentication helps protect account access. It cannot directly prevent a third-party airline reservation system from being compromised.

Secure your primary email

Your email address is often used for airline confirmations, password recovery, and travel notifications.

Protect it with a strong password and phishing-resistant authentication where available.

Google users can follow our guide to google account two step verification.

Avoid sharing booking references publicly

A booking reference is not always equivalent to a password, but it can be sensitive.

Avoid publicly posting boarding passes, confirmation emails, or reservation screenshots that display personal information.

Review your security habits regularly

Update your devices, avoid suspicious downloads, and verify the identity of websites requesting personal information.

For a broader routine, use our personal cybersecurity checklist.

Protecting personal information requires a combination of secure accounts, careful information sharing, and awareness of phishing attempts.

Is Japan Airlines Safe to Book After the Breach?

Japan Airlines stated that the security incident did not affect flight operations.

According to its official announcement, Amadeus completed necessary security measures and no misuse of the exposed information had been identified.

This means the reported incident does not establish that Japan Airlines flights or aircraft operations are unsafe.

However, the security of passenger information and the physical safety of airline operations are separate issues.

Passengers can continue monitoring official airline communications and independently verify their reservations.

As with any service handling sensitive customer data, users should remain attentive to future security updates.

Frequently Asked Questions

Was Japan Airlines hacked in October 2026?

Japan Airlines confirmed on October 28, 2026, that unauthorized access to an Amadeus passenger service system had affected customer reservation records.

The incident involved a third-party technology provider rather than a publicly confirmed compromise of every Japan Airlines system.

How many passengers were affected?

Approximately 92,000 passengers were affected across Japan Airlines and Japan Transocean Air.

Around 90,000 had basic reservation details exposed, while approximately 2,000 may also have had additional personal information accessed.

Were passport numbers stolen?

Japan Airlines identified passport numbers among the additional data potentially accessed for approximately 2,000 passengers.

The airline did not report that passport information was exposed for all 92,000 customers.

Were credit card details leaked?

No. Japan Airlines stated that credit card numbers were not compromised in the reported incident.

Were Japan Airlines account passwords exposed?

Japan Airlines reported that passwords were not compromised.

Passengers should nevertheless remain alert to phishing attempts that could seek to obtain their credentials.

Do passengers need to cancel their flights?

The airline reported no impact on flight operations, and its announcement did not advise passengers to cancel their bookings because of the breach.

Travelers should confirm flight information through official Japan Airlines channels.

How can I find out if my data was affected?

Japan Airlines said it would contact affected customers individually.

Passengers can also consult the airline’s official security notice and dedicated inquiry desk.

Can two-factor authentication stop airline data breaches?

No. Two-factor authentication can help prevent unauthorized account access, but it cannot directly stop every breach involving third-party reservation databases.

It remains an important part of a broader security strategy.

Final Thoughts

The Japan Airlines data breach announced on October 28, 2026, affected approximately 92,000 passengers through unauthorized access to an Amadeus reservation system.

While most affected records contained basic flight and booking details, approximately 2,000 passengers may also have had passport numbers, contact details, and frequent flyer information accessed.

Japan Airlines confirmed that credit card numbers and passwords were not exposed, no misuse had been identified, and flight operations remained unaffected.

Nevertheless, the incident creates potential opportunities for impersonation and phishing scams using travel-related information.

Passengers should review their bookings, monitor official airline communications, secure their accounts, and avoid responding to suspicious requests for personal information.

The most important lesson is to verify travel-related messages independently and never assume that someone possessing your booking details is a legitimate airline representative.