Amadeus Data Breach 2026: Japan Airlines, ANA, Korean Air and Asiana Booking Data Exposed
Amadeus breach 2026: JAL, ANA, Korean Air and Asiana Airlines booking records accessed. 92,000 JAL customers. PNR codes, names, flights, some passports.
Key takeaways
- Amadeus IT Group, a provider of airline reservation systems, notified Japan Airlines, ANA, Korean Air and Asiana Airlines in late October 2026 that traces were found indicating customer booking data had been accessed externally between August 2023 and September 2026.
- Japan Airlines disclosed that approximately 92,000 customers were affected. Data accessed included reservation codes (PNR), names, flight dates and sectors. Around 2,000 of those customers also had passport numbers, email addresses, phone numbers and frequent flyer details accessed. JAL says no credit card numbers or passwords were compromised.
- Korean Air and Asiana Airlines confirmed breaches but have not disclosed the number of affected customers or the full data categories. ANA said traces show some customer information was viewed, and the number and contents are still being investigated.
- Scammers can use a leaked booking record to send convincing messages claiming to be from the airline. Do not click links or call numbers in unexpected booking confirmation or re-booking messages. Open your airline app or type the official site yourself to check for changes.
Last updated: October 29, 2026. Based on notices from Japan Airlines, ANA, Korean Air, and Asiana Airlines, plus reporting from Kyodo News, The Record, Seoul Economic Daily, The Asia Business Daily, Nikkei, ITmedia, and iSec News.
One system, four airlines.
In late October 2026, Amadeus IT Group notified Japan Airlines, ANA, Korean Air and Asiana Airlines that traces were found indicating customer reservation data had been accessed externally. Amadeus provides the passenger service system these airlines use for flight reservations, ticketing and check-in.
Japan Airlines disclosed that approximately 92,000 customers were affected, with data accessed between August 2023 and September 2026. Korean Air, Asiana Airlines and ANA have confirmed incidents but have not yet disclosed customer counts or the full scope of data accessed.
The leaked booking details can be used to build convincing phishing messages that pretend to be the airline. This guide covers what was disclosed, what to do if you flew those airlines, and why a booking code matters.
Watch: Amadeus data breach explained
This Short walks through the breach and what happens when a booking record leaks.
What happened in the Amadeus data breach?
Amadeus IT Group is a provider of airline passenger service systems. Airlines use Amadeus software to manage flight reservations, ticketing and check-in procedures. In late October 2026, Amadeus notified Japan Airlines, ANA, Korean Air and Asiana Airlines that traces indicated customer data had been accessed externally.
Japan Airlines and Japan Transocean Air
On October 28, 2026, Japan Airlines posted a notice titled "Regarding Unauthorized Access to Amadeus Passenger Service System".
JAL stated that on October 23, 2026, JAL and Japan Transocean Air were informed by Amadeus that traces were found indicating a portion of customer reservation data had been accessed externally. JAL described Amadeus as the provider of their Passenger Service System "that integrates flight reservations, ticketing, and check-in procedures."
Affected customers: approximately 92,000.
Data accessed:
- For approximately 90,000 customers: reservation code (PNR), name, flight date, flight sector, class of service.
- For approximately 2,000 customers, additionally: email address, phone number, passport number, nationality, frequent flyer number, airline name, flight number, ticket number, seat number, and other details.
Period: Records with traces of external access are dated from August 10, 2023 through September 23, 2026.
Not compromised: JAL stated "No compromise of credit card numbers or any passwords."
JAL also noted that Amadeus has completed security measures, that there is no evidence of misuse so far, and that there has been no impact on flight operations. JAL said it will contact affected customers and remind them to watch for phishing emails, fraudulent phone calls, and fake websites impersonating JAL. A dedicated inquiry desk was opened from October 29.
Korean Air and Asiana Airlines
On October 23, 2026, Korean Air and Asiana Airlines confirmed customer data leaks from Amadeus.
According to Seoul Economic Daily and The Asia Business Daily, Amadeus notified Korean Air on the night of October 20, 2026.
Korean Air stated that the incident "resulted from unauthorized access using login credentials assigned to an Amadeus system account." The access is believed to have occurred between August 2023 and September 2026, with the exact timing under investigation.
Korean Air: Booking numbers were among the leaked data. The scale and data categories are not yet confirmed.
Asiana Airlines: Reservation-related information leaked. Payment information was not included.
Both airlines stated there were no signs that Korean Air or Asiana's own systems were breached. Korean Air emailed customers and warned against clicking unknown links or opening attachments.
ANA (All Nippon Airways)
On October 29, 2026, ANA posted a notice that unauthorized access at contractor Amadeus may have led to leakage of customers' personal information. Kyodo News and Nikkei reported the disclosure.
ANA said there are traces some customers' personal information was viewed. The number of affected customers and the contents of the leaked data are still being investigated.
According to Nikkei and ITmedia, ANA uses Amadeus's Altea system for international reservations (since 2015) and domestic reservations (since May 2026). StarFlyer, which uses the system via ANA, posted a similar notice on October 29.
What is a PNR, and why does it matter when it leaks?
PNR stands for Passenger Name Record, also called a booking code or record locator. It is a short alphanumeric code the airline gives you when you book a flight. Airlines use it to pull up your reservation.
A PNR plus your name and travel dates is enough for a scammer to build a message that looks like it came from the airline. Common scams include:
- Fake "re-confirm your flight" emails or texts with links to credential-harvesting sites.
- Calls claiming there is a problem with your booking and asking for payment or identity details.
- Passport verification phishing if the leak included passport numbers.
If the booking record also includes your phone number and email, the scammer can send a message that references your real flight and code. That makes the phish more convincing than a generic "your flight was canceled" spam.
The Record reported that Japan Airlines warned of the breach as the country grapples with a series of recent incidents. iSec News noted that the exposed reservation and identity details "could support targeted impersonation attempts."
What to do if you flew JAL, ANA, Korean Air or Asiana
If you are among the affected customers, the airline will contact you. Here is what to do whether you receive a notice or not.
Do not click links or call numbers in unexpected booking messages
If you get an email, text or call claiming to be the airline and asking you to re-confirm your flight, update payment, or verify your passport, do not click the link or call the number.
Open your airline app or type the official airline site into your browser yourself. Check your booking there for any unexpected changes.
Check your booking for unexpected changes
Log in to your airline account or enter your confirmation code on the airline's official site. If the booking was changed, contact the airline using the official phone number from their website.
Watch for passport-related scams if you were notified
If you were among the approximately 2,000 Japan Airlines customers whose passport numbers were accessed, watch for messages asking you to verify or re-submit passport details. Do not send a passport photo to an email address or upload it to a site linked from an unexpected message.
Use a unique password and enable two-factor authentication
Change your password on your airline account and frequent-flyer account if you have reused that password anywhere. Use a unique password for each account.
Turn on app-based two-factor authentication or add a passkey to your account. That way a leaked password alone is not enough to get in. Prefer an authenticator app or passkey over text-message codes.
Check where your contact details are listed online
Airline booking scams are more convincing when a scammer already has your name, phone number and home address from a people-search site. See how to remove your personal information from the internet.
UndoLeak erases your data from data brokers and keeps it off. A leaked booking record tells scammers your flight. Data brokers tell them where you live.
What the Amadeus breach does not tell us
The airline notices do not disclose who the attacker was, whether data has been published or sold, how the login credentials Korean Air mentioned were obtained, whether the same credentials were used for all four airlines, or whether other airlines using Amadeus were affected.
Amadeus IT Group has not issued a public statement as of the sources reviewed for this article.
Related reading
If you are concerned about your data in airport and travel systems, see:
- How to Opt Out of TSA Facial Recognition at the Airport
- How to Remove Your Personal Information from the Internet
Sources
Japan Airlines, "Regarding Unauthorized Access to Amadeus Passenger Service System" (October 28, 2026): https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html
Seoul Economic Daily, "Korean Air says customer data leaked at booking system" (October 23, 2026): https://en.sedaily.com/finance/2026/10/23/korean-air-says-customer-data-leaked-at-booking-system
The Asia Business Daily, "Korean Air customer data leak" (October 23, 2026): https://www.asiae.co.kr/en/article/2026102321412357867
Kyodo News, "Unauthorized access at ANA contractor may have leaked customer data" (October 29, 2026): https://english.kyodonews.net/articles/-/89809
Nikkei, "ANA unauthorized access article" (October 29, 2026): https://www.nikkei.com/article/DGXZQOUC295CD0Z21C26A0000000/
ITmedia, "ANA Amadeus Altea article" (October 29, 2026): https://www.itmedia.co.jp/news/article/2610/29/2000002722/
StarFlyer, "Regarding unauthorized access to Amadeus passenger service system" (October 29, 2026): https://www.starflyer.jp/news/2026/news_20261029_info.html
The Record, "Japan Airlines warns of breach in passenger service system as country grapples with incidents": https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents
iSec News, "Japan Airlines Amadeus Breach Exposes Reservation Data for 92,000 Travelers" (October 28, 2026): https://www.isec.news/2026/10/28/japan-airlines-amadeus-breach-reservation-data/
Not affiliated with Amadeus IT Group, Japan Airlines, ANA, Korean Air, Asiana Airlines, StarFlyer, or any organization mentioned.
Frequently asked questions
What is the Amadeus data breach?
In late October 2026, Amadeus IT Group notified Japan Airlines, ANA, Korean Air and Asiana Airlines that traces were found indicating customer reservation data had been accessed externally. Amadeus provides the passenger service system these airlines use for flight reservations, ticketing and check-in. The access period is believed to be August 2023 through September 2026.
How many people were affected by the Amadeus breach?
Japan Airlines disclosed approximately 92,000 affected customers. ANA, Korean Air and Asiana Airlines have not disclosed customer counts as of October 29, 2026. The number and scope are still being investigated.
What data was exposed in the Amadeus airline breach?
For Japan Airlines, approximately 90,000 customers had reservation codes (PNR), names, flight dates, flight sectors and class of service accessed. Around 2,000 additionally had email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, airline names, flight numbers, ticket numbers and seat numbers accessed. Korean Air said booking numbers were among the leaked data. ANA is still confirming the contents.
Were credit card numbers or passwords leaked in the Amadeus breach?
Japan Airlines stated that no credit card numbers or passwords were compromised. Asiana Airlines also said payment information was not included. Korean Air and ANA have not yet disclosed all data categories.
What should I do if I flew JAL, ANA, Korean Air or Asiana between 2023 and 2026?
If you are among the affected customers, the airline will contact you. Watch for phishing messages that pretend to be the airline. Do not click links or call numbers in unexpected booking messages. Open the airline app or type the official site yourself. Check your booking for unexpected changes. Use a unique password and turn on app-based two-factor authentication or passkeys on your airline and frequent-flyer accounts.
Was Amadeus IT Group's system hacked, or was it the airlines?
Based on the airline notices, the unauthorized access was to Amadeus's system, not the airlines' own systems. Korean Air's statement noted there were no signs Korean Air or Asiana's own systems were breached. Asiana also said the leak resulted from the reservation contractor's system.
Has Amadeus IT Group issued a public statement?
Amadeus has not issued a public statement as of the sources reviewed for this article. The disclosures came from Japan Airlines, ANA, Korean Air and Asiana Airlines.
Why does a leaked booking code matter?
A reservation code (PNR) plus your name and travel dates lets a scammer build a convincing message claiming to be the airline. Common scams include fake rebooking requests, payment demands, or passport verification phishing. Airline booking data can also support identity theft when combined with other details like passport numbers.
undoleak Team
