Amadeus Passenger Service System: booking-display flaw exposed airline passenger data for three years (JAL, ANA, Asiana, Korean Air)

What happened

• Amadeus said on 1 Oct 2026 it had found a vulnerability in its “travel booking display environment” that could expose traveler data, and that no payment data was exposed. JAL (28 Oct) says Amadeus notified it on 23 Oct of unauthorized access between 10 Aug 2023 and 23 Sep 2026: about 90,000 customers’ PNRs, names, flight dates, routes and classes, and about 2,000 more with email, phone, passport number, nationality and frequent-flyer numbers. Asiana and Korean Air confirmed impact; ANA reportedly too. Amadeus has not said which other airlines were affected.
• Root cause: a vulnerability in Amadeus’s booking display environment (no technical detail released).
• No attacker named.
• Airlines notifying passengers.

Sources

• https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/
• https://www.privacyguides.org/news/2026/10/30/data-breach-roundup-oct-23-oct-29-2026/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.