Japan Airlines has announced that a breach of Amadeus's Passenger Service System exposed data on about 92,000 of its customers, BleepingComputer reports. According to the airline, Amadeus told it on 23 October that unauthorised access to its systems lasted from 10 August 2023 to 23 September 2026. For about 90,000 customers, booking codes, names, flight dates and routes were exposed, and for another 2,000 also email addresses, phone numbers and passport numbers. All Nippon Airways, Asiana and Korean Air have confirmed similar impact, while card details were not affected.

What it means: Amadeus is one of global aviation's main technology suppliers, with hundreds of airlines, airports and hotels as clients, so a breach of its systems affects many organisations at once. The most worrying element is the duration: access appears to have lasted more than three years without detection, and the company had initially said the flaw had not been exploited. Booking codes together with a surname are often enough to access a reservation, and travel data can be used in convincing phishing messages about flight changes or refunds. Passport numbers raise the risk of identity fraud. It has not been made clear whether European airlines or hotels are affected, but many Greek tourism businesses and travel agencies use Amadeus systems. If exposure of European travellers' data is confirmed, GDPR notification duties will apply to the data controllers. For businesses, the case is a reminder that supplier contracts should provide for immediate notice and access to investigation findings. Travellers need to be wary of messages asking for payments or details in connection with bookings.

Read the original on BleepingComputer

Related service: Custom software

Related stories