Flown JAL, ANA or Korean Air since 2023? Your booking details may have leaked through Amadeus

Japan Airlines is the latest carrier to tell passengers their booking details walked out the door, and the breach wasn't at the airline. It was at Amadeus, the IT company whose Passenger Service System handles reservations, ticketing and check-in for a large share of the world's airlines. Amadeus told JAL on 23 October that someone had unauthorised access between 10 August 2023 and 23 September 2026. That's more than three years.

For about 90,000 JAL customers the exposed data is booking reference codes, names, flight dates, routes and travel class. For roughly 2,000 more it goes much further: email addresses, phone numbers, passport numbers, nationalities and frequent flyer numbers. JAL says card numbers and passwords weren't involved and it has seen no misuse. Korean Air got its own notice on the night of 20 October and says the intruder used login credentials assigned to an account in Amadeus's system. ANA and Asiana have confirmed they're affected as well, and Amadeus hadn't answered BleepingComputer's question about how many other airlines are in the same position.

A booking reference plus a surname is exactly what an airline's manage-booking page asks for, which makes this more useful to a scammer than it first sounds. Expect emails and texts that quote a real flight, a real route and a real reference, then ask you to pay for a schedule change or claim compensation. Correct details are no longer proof that a message is genuine. Open the airline's app or type its address yourself instead of following a link, and look through your frequent flyer account for points you didn't spend. Korean Air's own advice is the same: no unknown links, and no personal details in reply to messages you weren't expecting.

If your frequent flyer login shares a password with anything else, change that one first; Tendvane's Privacy & accounts check is a reasonable place to review which of your accounts need attention.