Short answer
Korean Air and Asiana said on 23 October 2026 that customer reservation data leaked from Amadeus, the airline IT provider. On 28 October JAL and JTA said about 92,000 of their customers' bookings were also viewed. Payment card numbers and passwords were not exposed, the airlines say.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Amadeus IT Group (Korean Air, Asiana Airlines, JAL, JTA customers) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Airlines and travel technology |
| Country | Multiple (South Korea, Japan) |
| Detected | 2026-10-20 |
| Disclosed | 2026-10-23 |
| People or records affected | About 92,000 JAL and JTA customers; Korean Air and Asiana have not given a number |
What data was exposed
- Booking reference numbers (Korean Air and Asiana)
- Name, travel date, route and cabin class (JAL and JTA, about 90,000 people)
- For about 2,000 JAL and JTA customers: email, phone, passport number, nationality, mileage number, ticket and seat details
What happened
Amadeus runs reservation systems for airlines worldwide. In October 2026 four carriers told customers that booking data held there had been seen by an outsider.
Korean Air said Amadeus notified it at 10:44 pm on 20 October. The carrier and Asiana Airlines went public on 23 October. According to Korean Air, an unauthorized party used login credentials tied to an Amadeus system account. The airline estimates the access ran from August 2023 to September 2026, with exact dates still under investigation.
Five days later, on 28 October, Japan Airlines and its group carrier JTA announced that about 92,000 customers’ bookings may have been viewed from outside. JAL says Amadeus reported the intrusion to it on 23 October.
What was seen
For Korean Air and Asiana, the confirmed item is reservation numbers. Korean Air says other fields are still being verified. Neither airline has given a customer count.
JAL gave more detail. About 90,000 people had a booking reference, name, travel date, route and cabin class viewed. About 2,000 had more: contact details, passport number, nationality, mileage number, airline, flight and ticket numbers and seat information. JAL says card numbers and passwords were not leaked, and no misuse has been confirmed.
Responses
Amadeus has blocked the unauthorized access and turned on dark web monitoring, according to Korean Air as reported by Money Today. The Japanese carriers say Amadeus has put the needed security measures in place. Flights were not disrupted. JAL will contact affected customers individually. ZDNet Korea says Korea’s privacy regulator may look into the case, but no investigation is confirmed.
Scam angle
A booking reference plus a name and route is what a convincing fake “your flight has changed” text needs. Our guides on phishing messages and toll and delivery text scams show the pattern, and the data breach checklist covers next steps. People whose passport details were involved should also read about government impersonation scams.
What is still unknown
Amadeus has not made a public statement in the material we reviewed. The size of the Korean Air and Asiana exposure and whether other airlines are involved are unclear. See the breaches index and our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake booking-change or refund emails that quote a real reference number and route.
- Smishing about a cancelled flight, seat upgrade or baggage fee with a link to a fake airline page.
- Calls to the roughly 2,000 JAL and JTA customers whose passport numbers may have been viewed, claiming an immigration or visa problem.
- Fake JAL or Korean Air customer support sites that ask for card details.
What to do if you are affected
- 01Do not click links or open attachments in unexpected airline messages. Open the airline's app or type its address yourself.
- 02Check your booking only through the official airline app or site, and ignore requests to pay a 'fee' by link.
- 03If JAL tells you your passport number was viewed, watch for identity fraud and treat any call about visas or immigration as suspect.
- 04In Korea, report suspected smishing to KISA on 118 and the police on 112. In Japan, use #9110 and the consumer hotline 188.
- 05JAL's contact line is 0120-25-6050 or 03-4332-7280 (10:00 to 17:00 Japan time, weekdays).
Frequently asked questions
Was my Korean Air or Asiana payment information leaked?
ZDNet Korea reports that payment data such as card numbers was not included in the leak. Neither airline has listed every affected data field yet, so watch for further notices.
How did the attacker get into Amadeus?
According to Korean Air, an unauthorized party used login credentials assigned to an account on the Amadeus system. How the credentials were obtained has not been explained.
How long was the access possible?
Korean Air estimates August 2023 to September 2026, with exact timing under investigation. JAL says the viewed records date from 10 August 2023 to 23 September 2026.
Were the airlines' own systems hacked?
According to ZDNet Korea and Money Today, no intrusion into Korean Air's or Asiana's own databases has been identified. The reported leak came from Amadeus.
Is the Korean Air and JAL breach the same incident?
Reports tie both to unauthorized access at Amadeus, but the airlines disclosed on different dates and Amadeus has not published a public statement in the sources we read. Treat them as one vendor incident with separate customer notices.
Sources
- Korean Air customer data leak reported (English edition), Money Today, 2026-10-23
- 대한항공·아시아나, 개인정보 유출 확인…IT 협력사가 '구멍' (Korean Air and Asiana confirm personal data leak: IT partner was the hole), ZDNet Korea, 2026-10-24
- JALとJTA、アマデウス不正アクセスで予約情報9.2万人対象 (JAL and JTA: 92,000 people's booking data in Amadeus unauthorized access), Aviation Wire, 2026-10-28
- JAL・JTA Amadeus不正アクセスに関する報道 (JAL and JTA Amadeus unauthorized access report), Travelvoice, 2026-10-28
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.