A breach of travel technology provider Amadeus’s passenger service system exposed reservation data for tens of thousands of Japan Airlines and All Nippon Airways customers, including passport numbers and nationalities for about 3,700 travelers across the two airlines.
Japan Airlines said Amadeus notified it on Oct. 23 of unauthorized access to its systems between Aug. 10, 2023 and Sept. 23, 2026. JAL Group, which operates JAL and Japan Transocean Air, uses the system to handle reservations, ticketing and check-in. For about 90,000 customers, the exposed data covered passenger name record (PNR) reservation codes, names, flight dates, routes and travel classes.
For another 2,000 JAL customers, the exposed data also included email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers and flight, ticket and seat numbers. The airline said credit card numbers and passwords were not compromised and that it has no evidence that customer information has been misused. It said Amadeus has put the necessary security measures in place and that flight operations were not affected.
All Nippon Airways, which identified Amadeus IT Group on Thursday as a contractor that had experienced unauthorized access, said Friday that information belonging to about 37,800 customers had leaked. The affected customers booked ANA-operated flights between Aug. 10, 2023 and Sept. 23, 2026. Names, reservation numbers, travel dates and flight segments were exposed, and passport numbers and nationalities were leaked for 1,700 of those customers. ANA said no credit card details or passwords were exposed.
Asiana Airlines and Korean Air have also confirmed that they were affected by the Amadeus flaw. The Spain-based company provides technology to travel agencies, airlines, airports and hotels, and its systems are used by more than 400 airlines and 210 airport operators. It also supplies airport biometrics: London City Airport selected Amadeus this month for biometric check-in kiosks and automated bag drop.
In an Oct. 1 statement, Amadeus said it had discovered a vulnerability in its travel booking display environment that could expose travelers’ data. At the time, the company said ransomware actors had not exploited the flaw and that no payment or other financial data had been exposed.
Sources: BleepingComputer, News.az
–
By the ID Tech Editorial Team
