JP — ITmedia

Unauthorized Access to JAL Reservation System Exposes Data of About 90,000 People, Including Passport Numbers for Some

SecurityOctober 28, 20261 min read

Japan Airlines (JAL) and Japan Transocean Air (JTA) say hackers got into a booking system run by an outside company. About 92,000 customers' booking records may have been viewed, and some also include passport numbers.

What happened

JAL and JTA said on October 28, 2026 that an outside company, Amadeus, was hacked. Amadeus runs the passenger service system that handles bookings, ticket issuing, and check-in for both airlines. Records that may have been viewed by outsiders were for flights booked between August 10, 2023 and September 23, 2026. The airlines say flight operations are not affected.

Key numbers and facts

About 92,000 people may have had their booking data viewed.
About 90,000 of them: booking number, name, flight date, route, and cabin class may have been viewed.
About 2,000 of them: email, phone number, passport number, nationality, mileage number, airline, flight number, ticket number, and seat number may also have been viewed.
No leaks of credit card numbers or passwords have been confirmed.
The airlines learned of the problem from Amadeus on October 23, 2026.

Background

A booking system is the computer tool that stores who is flying, when, and where. Airlines often use outside companies to run these systems. That means a hack at one provider can affect many airlines at once.

Why it matters

Passport numbers and contact details can be used by scammers. Amadeus says it has finished its security fixes and has not seen misuse of the data as of October 28. Still, customers should be careful with strange emails, calls, or fake websites that pretend to be JAL.

What to watch

JAL and JTA plan to contact affected customers one by one.
A special support desk opens on October 29, 2026.
Watch for signs that the stolen data is being misused.
Watch for more details on how the attack happened.

Glossary

Amadeus: A Spanish company that runs travel booking and passenger service systems for airlines.
JAL: Japan Airlines, a major Japanese airline.
JTA: Japan Transocean Air, an airline in the JAL Group.

NEC Apologizes for Information Leak at Contractor, Says It Is Reflecting as a Security Business

At its Q2 earnings briefing on October 28, NEC Vice President and CFO Kazukazu Amemiya apologized for a security incident involving a contractor, saying that as a company in the security business it deeply regrets the incident. NEC had announced on October 20 that a system development and maintenance contractor was hit by a cyberattack in late September, affecting customers, and that a cloud storage service used for information sharing also leaked files containing personal data. Amemiya said NEC is prioritizing responses to regain customer trust and strengthening its management structure.

SecurityThe RegisterOct 28

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

UK domain registrar 123 Reg says it suffered an "AI-driven cyberattack" on September 18 that exposed customer data, including contact details, VAT numbers and API product information. The company says its investigation found attacker infrastructure hosted in China and Singapore and suspects a China-linked group, possibly the same actor that used the open-source ARTEX tool against South Korean financial institutions. 123 Reg says it believes the attacker only read customer data but may have made copies, and has urged customers to be wary of unsolicited messages.

SecurityArs TechnicaOct 28

China’s snooping around Pacific undersea cables raises risks for Big Tech

A new report says subsea cables owned by US companies such as Google and Meta face some of the greatest risks of deep-sea sabotage in the Pacific Ocean, as Chinese research ships spend unusual amounts of time apparently surveying cables. The report, contracted to the London-based China Strategic Risks Institute and published by the US-China Economic and Security Review Commission in September 2026, includes an interactive Trans-Pacific Cable Gray Zone Vulnerability Index that ranks at-risk cables using factors such as depth, shipping traffic, ownership, and whether a cable connects to Taiwan.

SecurityITmediaOct 28

"Servers with Delayed Security Measures Are Being Targeted Across the Board": Luck CTO Warns Amid Successive Unauthorized Access

At KDDI SUMMIT 2026 on October 28, Luck CTO Hiroaki Kuramochi said that systems with postponed security measures, such as delayed vulnerability assessments, lack of WAF, or outdated PHP versions, are being targeted across the board. He noted that AI has sharply reduced the cost and time needed for attackers to scan systems and exploit vulnerabilities, and that infostealer malware is stealing employee credentials, making perimeter monitoring alone insufficient. He recommended deploying EDR on servers and penetration testing, and said AI has not created entirely new problems but has exposed long-overlooked weaknesses.