Amadeus Passenger Service System Breach Exposes 92,000 Japan Airlines Passengers
What Happened — Between 10 August 2023 and 23 September 2026, attackers gained unauthorized access to Amadeus’s Passenger Service System (PSS), the reservation, ticketing and check‑in platform used by Japan Airlines (JAL) and its subsidiaries. The intrusion was disclosed to JAL on 23 October 2026. As a result, reservation codes, names, flight dates, routes and travel classes for roughly 90 000 passengers were exposed. An additional 2 000 records also contained email addresses, phone numbers, passport numbers, nationalities, frequent‑flyer numbers and seat details. Credit‑card numbers and passwords were not compromised. Amadeus says it has now applied additional security controls; flight operations remain unaffected.
Why It Matters for Trust & Control Assurance — The incident highlights the critical need for continuous third‑party risk monitoring and evidence‑based assurance of vendor security controls.
Who Is Affected — Airlines and travel‑technology providers (aviation / transport logistics).
Recommended Actions
- Review and update third‑party risk management policies to require real‑time security posture evidence from SaaS vendors.
- Map the vendor‑access control findings to your audit‑readiness framework and collect defensible evidence of remediation.
- Conduct a focused audit of any downstream integrations that rely on the compromised PSS.
Technical Notes
- Attack vector: exploitation of a vulnerability in Amadeus’s travel‑booking display environment, leveraged through valid credentials obtained from the supplier.
- Data types exposed: reservation details, personal identifiers (passport, nationality), frequent‑flyer numbers; no payment credentials.