Japan Airlines (JAL) announced on 29 October that a data breach at Amadeus's Passenger Service System exposed the information of about 92,000 customers — the Amadeus platform JAL uses for reservations, ticketing and check-in. Amadeus notified JAL on 23 October that unauthorised access occurred between 10 August 2023 and 23 September 2026: approximately 90,000 customers had reservation codes (PNRs), names, flight dates, routes and travel classes exposed, while a further 2,000 also had email addresses, phone numbers, passport numbers, nationalities, frequent-flyer and ticket data taken. JAL says no credit card numbers or passwords were compromised and there is no evidence of misuse. The breach stems from a vulnerability in Amadeus's travel booking environment disclosed 1 October, which Amadeus had said was not maliciously exploited — JAL's disclosure confirms it was. ANA has also confirmed impact, joining South Korean carriers Asiana and Korean Air, with the full airline blast radius still unknown given Amadeus's reach of more than 400 airlines worldwide.

• Source article