Amadeus‑Hosted Reservation System Leak Exposes 92,000 Japan Airlines Customers
What Happened — Japan Airlines disclosed that its reservation, ticketing and check‑in platform, operated by Amadeus IT Group, was breached. Hackers accessed a “portion of customer reservation data” for Japan Airlines and Japan Transocean Air flights, compromising personal records of 92 000 passengers. Names, reservation codes and flight details were taken for the full set; for about 2 000 travelers, passport numbers, frequent‑flyer IDs, email addresses and phone numbers were also stolen. Flight operations and credit‑card data were not affected. The breach was reported by Amadeus to JAL last week, and the airline is notifying affected customers and warning of phishing attempts.
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust third‑party risk management and continuous monitoring of vendor access controls.
Who Is Affected — Airline and travel‑technology providers; their customers whose reservation data were exposed.
Recommended Actions
- Review and tighten third‑party contracts to require regular security attestations and breach‑notification clauses.
- Request and validate evidence of Amadeus’s access‑control and monitoring controls (e.g., log retention, privileged‑account management).
- Enhance customer‑notification procedures and run targeted phishing‑awareness campaigns for the exposed cohort.
Source: The Record
Technical Notes — Attack vector: unauthorized access through a third‑party reservation system (no specific vulnerability disclosed). Exfiltrated data: names, reservation codes, flight itineraries; for a subset, passport numbers, frequent‑flyer numbers, email and phone contacts. Source: same as above