Japan Airlines has warned that hackers accessed a portion of reservation data held by its provider Amadeus, exposing information on 92,000 customers of JAL and Japan Transocean Air. For about 2,000 of them, passport numbers, frequent flyer numbers, email addresses and phone numbers were also taken.
What JAL Says Was Taken From Amadeus Reservation Systems
JAL said Amadeus informed it last week that attackers had reached part of the reservation data the vendor holds. For the full group of 92,000 customers, the exposed information is names, reservation codes and flight information. The more sensitive set of roughly 2,000 customers also lost passport numbers, frequent flyer numbers, emails and phone numbers.
JAL says flight operations are unaffected and that credit card numbers were not compromised. The airline will contact affected customers individually and has warned them to watch for phishing, since names and booking details are enough to build convincing fake messages about a trip.
Amadeus as the Point of Failure
The breach took place at Amadeus IT Group, the reservation provider, not at JAL’s own systems. The airline learned of it from the vendor, which fits a pattern in which customer data lives with a supplier that serves many airlines. The reporting does not say how the attackers got into Amadeus, when the intrusion happened, or whether other airlines were affected.
A Wave of Japanese Breaches Draws a Government Response
The JAL disclosure comes during a run of data breaches in Japan. Coverage of the JAL notice lists Sony Network Communications, Burger King Japan with 11 million records, Capcom with 11.7 million and GMO Internet among the incidents. Prime Minister Sanae Takaichi held a cabinet meeting on Monday on the issue and promised emergency measures.
Sony Network Communications as the Latest Case
The Sony Network Communications breach, which exposed about 2.58 million records, is covered in companion reporting. The government package has not yet been detailed, and the individual incidents have not been linked to one another in public reporting.
Why Supplier Breaches Complicate Airline Data Protection
The airline case shows how a company can be fully transparent with customers and still have little control over the cause. JAL’s notice depended on Amadeus telling it about the intrusion, and JAL heard from the vendor only last week.
The categories of data matter. Names plus reservation codes and flight information give a criminal enough to impersonate the airline in a message that references a real booking. For the 2,000 customers whose passport numbers and contact details were also taken, the exposure is more serious, because passport data is difficult to change and useful for identity fraud.
Cabinet-level attention is itself a sign of how the pace of Japanese disclosures has changed. With several large consumer-facing companies reporting incidents in a short span, the promised emergency measures may reach beyond individual company obligations, but their content is not yet known. For third-party providers like Amadeus, the open question is whether any new rules would apply to the vendors that hold the data, as opposed to the airlines that face customers.
The exposure has two tiers. Most of the 92,000 customers lost information that is useful mainly for phishing, while the 2,000 whose passport numbers were taken face a more durable risk. JAL has said it will contact those affected, and it advises them to be wary of unsolicited messages. The company has not stated whether it will offer identity protection to the smaller group.
Amadeus has not publicly described its own findings in the reporting available so far, and JAL’s notice relies on what the vendor told it. Until the reservation provider explains the scope of the access, it is unclear whether the 92,000 figure is final or whether more customers of other carriers will be added to the count.
