Airline Booking Data Exposed: How Travelers Can Avoid Scams

A breach at travel tech firm Amadeus exposed flight details for JAL customers. Here is how to spot fake booking messages and stay safe.

Japan Airlines says a data breach at Amadeus, a travel tech company, exposed details for about 92,000 of its customers. Other airlines in Japan and South Korea report links to the same breach, so treat any message about your booking with care. Check your trip only through the airline's own app or website.

What happened

Amadeus runs a system that many airlines use for bookings, tickets and check-in. BleepingComputer reports that the JAL Group uses this system. The group runs JAL and Japan Transocean Air.

Amadeus told the airline on October 23, 2026, that someone got into its systems without permission. That access lasted from August 10, 2023, to September 23, 2026.

Other airlines have also reported impact from the same Amadeus breach:

• All Nippon Airways (ANA), according to local media.
• Asiana Airlines.
• Korean Air.

ANA also paused some services on its website and app starting October 21. The report says that pause seems tied to a different threat called PHP2Shell. The Hacker News reports that attackers used PHP2Shell to gain full control of 25 servers in the U.S., Japan, Taiwan and South Korea.

Amadeus is used widely in travel. It serves over 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. BleepingComputer asked Amadeus if more airlines or countries were affected. The company had not shared more details when the story was published.

What information was exposed

For about 90,000 JAL customers, the exposed data was:

• Reservation codes. This is the short code of letters and numbers on your booking. Airlines call it a PNR.
• Names.
• Flight dates and routes.
• Travel class, such as economy or business.

For about 2,000 more customers, more was exposed. This included email addresses, phone numbers, passport numbers, nationalities and frequent flyer numbers. It also included flight, ticket and seat numbers.

JAL says credit card numbers and passwords were not part of the breach. It says it has no sign so far that anyone has misused customer data. Amadeus has put security fixes in place, and flights are running as normal.

One point to know. On October 1, 2026, Amadeus said it had found a weakness in its booking display system. At that time, it said no ransomware group had used it. Ransomware groups are criminals who lock files and demand payment. Amadeus also said payment and financial data stayed safe. JAL's later notice suggests the weakness was likely exploited. The two statements came at different times, based on what was known then.

How scammers could use this data

Your name, flight and booking code are not a password. But they can make a fake message look real. A scammer who knows your route and travel date can write an email that sounds just like your airline.

Here are some ways a trick like this could work:

• An email says your flight changed. It asks you to click a link to confirm.
• A caller says your seat or passport needs fixing. They ask for card details.
• A text says you are owed a refund. It sends you to a fake sign-in page.

Travelers who booked with JAL between August 10, 2023, and September 23, 2026, should pay the most attention. Families who book for relatives and small businesses that book staff travel should too.

Steps to stay safe

1. Do not click links in surprise messages about your flight. Open the airline app, or type the web address yourself.
2. If someone calls about your booking, hang up. Call back using the number on the airline's official website.
3. Never give card numbers, passwords or one-time codes to someone who contacted you first.
4. A correct booking code does not prove a message is real, so check it through the airline first.
5. Check your frequent flyer account for changes you did not make, such as used miles.
6. Turn on two-step sign-in for your airline account if it is offered. This means you need a second code, not just your password.
7. If you book trips for family or staff, share these steps with them.

What to do if you were tricked

• You typed a password on a fake page: Change it now on the real site. Also change it anywhere else you used the same password.
• You gave card details: Call your bank using the number on the back of your card. Ask them to watch for or block strange charges.
• You shared your passport number: Contact the office that issued your passport and ask what to do next.
• You got a fake message: Report it to the airline through its official website.
• Keep records: Save screenshots, phone numbers and dates. They help your bank and the airline.

Stay calm and move step by step. JAL says card numbers and passwords were not part of this breach. A fake message that looks real is the main thing to watch for, so slow down before you click or share.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Japan Airlines suffers third-party data breach exposing passenger info, BleepingComputer, 2026-10-29
• PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network, The Hacker News, 2026-10-28