Identity

Three Asian airlines have now told customers that booking data was taken from Amadeus IT Group, the company that runs their reservation, ticketing and check-in systems. Korean Air and Asiana Airlines disclosed on October 23 that Amadeus had warned them on the night of October 20. Korean outlets report that someone used valid login credentials assigned to an account in Amadeus' system to read customer records. Japan Airlines (JAL) followed on October 28: Amadeus told JAL and its subsidiary Japan Transocean Air (JTA) on October 23 that records for about 92,000 customers may have been viewed.

No airline says its own network was breached, and none reports card data stolen. The risk for travellers is targeted phishing that quotes a real booking code and flight. The lesson for airlines, travel agencies and corporate travel teams is about who holds logins to a platform that sits outside their own controls. Amadeus has not published its own statement, and the airlines have not said whether the Japanese and Korean cases come from the same account or the same intrusion. Both describe access windows that start in August 2023.

What was taken

JAL gives the most detail. For about 90,000 customers, the exposed fields are the reservation code, name, flight date, route and class of travel. For about 2,000 of them, the records also held email address, phone number, passport number, nationality, frequent flyer number, ticket number, flight number and seat. JAL says credit card numbers and passwords were not involved, flight operations were not affected and no misuse has been confirmed. The scope covers flights with JL or NU flight numbers whose reservation records sat in Amadeus' systems between August 10, 2023 and September 23, 2026. That window refers to when the data was held, not to when people booked or flew.

Korean Air has confirmed that booking reference numbers were exposed and says the full scope is still under investigation with Amadeus. Asiana says reservation information leaked but payment data did not, because it processes payments on a separate system. Neither Korean carrier has published a customer count. Korean Air emailed affected customers on October 23 and says it will write again if more data types are found.

How it works

A passenger service system (PSS) is the hosted platform that holds an airline's reservations, issues tickets and runs check-in. The airline does not run it: Amadeus does, and the airline's staff, contact centres, ground handlers and contractors reach it through user accounts that Amadeus issues. Each booking is a passenger name record (PNR), identified by a six-character code, the reservation or booking code printed on every itinerary.

According to Korea Times, Seoul Economic Daily, Herald Business and Asia Business Daily, the access to Korean Air and Asiana records used login credentials assigned to an Amadeus system account. No outlet says how those credentials were obtained, whose account it was, or whether a second factor was required. JAL has not said how the access to its records happened.

This matters for detection. An intruder with a working login does not need to exploit a flaw. Every lookup looks like a normal agent query, so nothing in the airline's own logs fires, and the airline's firewall and endpoint tools never see it. Both Korean airlines stress that their internal databases were not touched, which is consistent with access that happened entirely inside the vendor platform. The estimated window runs to about three years. The sources do not say whether the account was active through all of it, but a window that long suggests the access was not caught by any check on how many records an account opens.

What attackers can do with the data

The most direct use is phishing that is hard to tell apart from the airline. A message that quotes the right name, booking code, route and date can ask the traveller to "confirm passport details", pay a fee for a schedule change or log in to a frequent flyer account. JAL warns customers about emails, phone calls and websites that impersonate the JAL Group, and Korean Air tells customers not to click links or open attachments from unknown senders.

The 2,000 JAL records with passport number, nationality and phone number carry more risk: they support identity fraud and convincing voice calls. Frequent flyer numbers are a target in their own right, since miles can be redeemed or transferred once the account is taken over. Amadeus is monitoring the dark web for the data, according to the Korean airlines; nobody has reported it on sale.

What to do

Amadeus has not published technical indicators, so the steps below are the controls that address credential misuse on any hosted reservation or global distribution system (GDS), not vendor-specific fixes.

Airlines and travel agencies with reservation system logins

1. Get the full user list for every office or agency ID your organisation holds on the platform, including accounts issued to contractors, call centres and ground handlers. Disable any account without a named owner, and any that has not signed in for 90 days.
2. Require single sign-on (SSO) through your own identity provider, or the vendor's multi-factor authentication (MFA) where SSO is not offered, for every account that can read or change bookings. Shared logins at airport counters and call centres are where this usually breaks down; replace them with named accounts.
3. Ask the vendor for sign-in and query logs for your accounts back to August 2023. Look for sign-ins from countries or networks where you have no staff, sessions outside shift hours, and accounts that opened far more PNRs per day than their peers or opened bookings outside their market.
4. Rotate passwords on every account the vendor flags, and on any service or API account whose secret has not changed in the last year.

Corporate travel managers

Ask your travel management company whether its Amadeus or other GDS accounts were among those reviewed, and whether your travellers' profiles were in scope. Check what your profiles push into each booking. Passport and date of birth are needed for advance passenger information, but many profiles copy them into every PNR by default, including domestic trips where no one asks for them. Removing them where they are not required limits what the next account compromise can reveal.

Send travellers a short note now: the airline will not ask for passport details or payment by email or text, and the booking code in a message does not prove it is genuine. Tell them to reach the airline through its app or a number they type themselves.

Notification

A vendor's notice can start your own reporting clock. Under the EU General Data Protection Regulation (GDPR), Article 33 gives a controller 72 hours from becoming aware of a breach to notify its supervisory authority, and allows the details to follow in phases. Japan and Korea have their own reporting rules for leaks of this size, with deadlines counted in days. Bring legal in on the day the vendor's notice arrives, rather than waiting for the vendor to finish scoping.

The wider lesson

Vendor reviews tend to stop at the vendor's certifications. The question this case raises is who holds logins to the platform on your behalf, whether those logins need a second factor, and whether anyone looks at how many records each one reads. A customer can ask for each of those in the contract and check them every quarter: an export of active users, the MFA setting per account, and query counts per user.

Our safeguarding and hardening work covers access reviews and MFA rollouts for third-party platforms, and our security operations team can build the volume and location checks on vendor access logs. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: The Record, Japan Airlines notice, TRAICY Global, aeroTELEGRAPH, Cypro, The Korea Times, Seoul Economic Daily, The Herald Business, The Herald Business, Asiana, The Asia Business Daily, OODA Loop, PIPC leak reporting, GDPR Article 33.