Japan Airlines (JAL) and Japan Transocean Air (JTA) said on October 28 that a system provider handling their bookings and check-in had been breached, and that records for about 92,000 passengers appear to have been viewed from outside. Passport numbers and phone numbers were among the data in some cases. Flights were not affected, the two airlines said.
The records that appear to have been viewed cover bookings made under JAL and JTA flight numbers between August 10, 2023 and September 23, 2026. For about 90,000 of the people affected, the exposed data appears to be the booking number, name, flight date, route and cabin class.
For the remaining roughly 2,000, the same details plus email address, phone number, passport number, nationality, mileage number, airline, flight number, ticket number and seat number also appear to have been viewed. No credit card numbers or passwords have been confirmed as leaked, the airlines said.
Breach at Amadeus
The unauthorized access was to a passenger service system run by Spain's Amadeus IT Group, S.A., which processes reservations, ticketing and check-in for both airlines as a single operation. JAL and JTA received a report of the breach from Amadeus on October 23.
Amadeus has completed the necessary security measures, and as of October 28 no misuse of the information had been confirmed, according to the two airlines.
Passport numbers held by default
Passport numbers are the most sensitive item on the list. They are routinely collected with international bookings, so an airline's reservation system holds them for large numbers of travelers who never chose to hand them over to anyone else. Combined with a name and date of birth, a passport number is the raw material for identity theft and for fraud against border and immigration systems.
JAL and JTA plan to contact each affected person individually. They also urged customers to watch for suspicious emails and calls, and for fake sites set up to look like the JAL Group. A dedicated inquiry desk opens on October 29.