JAL and JTA disclose external access to about 92,000 customers’ Amadeus reservation records
JAL/JTA report traces of external access affecting about 92,000 customers in Amadeus. About 2,000 customers also had additional fields such as passport/contact details accessed. The airlines report no card-number/password compromise, confirmed misuse or flight disruption.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Some JAL/JTA reservation records in Amadeus; access method and attacker are undisclosed
- aviation · third party · data exposure
- In the wild
- Not applicable
- Confirmed unauthorized access; no specific software vulnerability disclosed.
What happened
The vendor-confirmed total separates about 90,000 customers with booking code, name, flight date, sector and class from about 2,000 with additional fields such as email, phone, passport number, nationality, frequent-flyer number, airline, flight/ticket number and seat. It is not 92,000 passport records. L4 reflects the scale of personal-data exposure. Amadeus has completed security measures; the notice does not identify a root cause or establish ongoing access.
Crime-scene timeline
Oct 23, 2026
Amadeus informs the airlines
Oct 28, 2026
JAL and JTA publish the affected scope
Oct 29, 2026 (scheduled)
Dedicated inquiry desk opens
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- JAL/JTA official disclosurePrimaryOctober 28 notice: affected fields, approximate populations, access-trace window, containment and customer contact.