When one software vendor powers hundreds of airlines, one breach can spread across an industry.
Japan Airlines says unauthorized access to the Amadeus Passenger Service System, which JAL Group uses for reservations, ticketing and check-in, exposed data for about 92,000 customers of JAL and Japan Transocean Air. Amadeus notified the airline on October 23. The access took place between August 10, 2023, and September 23, 2026.
What was exposed
For about 90,000 customers, the attacker accessed booking codes, names, flight dates, routes and travel classes. For about 2,000 more, the exposed data also included email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket and seat numbers.
JAL says credit card numbers and passwords were not compromised and that it currently has no evidence of misuse. Flight operations are unaffected, and Amadeus has put the necessary security measures in place, the airline said.
Not just one airline
Amadeus supplies technology to more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels, BleepingComputer reports. On October 1, Amadeus disclosed a vulnerability in its travel booking display environment that could expose traveler data, saying at the time that no payment data had been exposed.
JAL’s notice suggests that flaw was exploited. All Nippon Airways has also reported a customer data breach tied to Amadeus, according to local media, and Asiana Airlines and Korean Air have confirmed impact as well. Amadeus had not told BleepingComputer how many other airlines or markets were affected.
Why it matters
This is a textbook third-party risk event: the airlines did not get breached directly, but their customers’ data was still exposed, apparently for years. Shared platforms concentrate risk across whole industries.
For security vendors focused on vendor risk management, data security and threat detection, it is a strong, concrete example to bring to conversations with CISOs and procurement teams. Buyers respond to outreach that helps them answer a simple question: which of our vendors could expose us next?
Sources: Japan Airlines, BleepingComputer. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.