What was viewed. Bookings made from Aug 10, 2023 to Sep 23, 2026. For about 90,000 people: booking code, name, flight date, route and cabin class. For about 2,000 more: email, phone, passport number, nationality, frequent flyer number, ticket and seat numbers. JAL says no card numbers or passwords leaked, no misuse has been seen, and flights weren't affected. Amadeus says it has finished its security fixes. How the attacker got in and how many other airlines were hit: Undisclosed. Nikkei reports ANA, which moved fully onto Amadeus Altea in May 2026, is still checking.
Why it matters. Amadeus Altea is the cloud system much of the airline industry runs bookings on, so one intrusion there can reach many carriers at once. A booking code plus a surname is often enough to open and change a trip online, and passport numbers make fake airline refund and rebooking scams far more convincing. This is a classic third-party breach: the customer is the airline's, but the data sat with the vendor.
What I'd do today. If your staff fly JAL, JTA or ANA, warn travel teams and frequent flyers to expect phishing that quotes real booking codes and to rebook only through official apps. If you run on a shared SaaS platform like Altea, ask the vendor in writing whether your tenant was in scope and for the access logs, not just a yes or no. And for any vendor holding passport data, check how long they keep it. Three years of bookings was sitting there to be read.