**Japan Airlines (JAL)** has confirmed a data breach originating from its use of **Amadeus's Passenger Service System**. The breach, which **Amadeus** first notified **JAL** about on October 23, 2026, involved unauthorized access to its systems between August 10, 2023, and September 23, 2026. ### Scope of the Breach The lengthy compromise resulted in the exposure of reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers. A smaller group of 2,000 customers had more sensitive data exposed, including email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and specific flight, ticket, and seat information. **JAL** has assured customers that credit card numbers and passwords were not compromised, and as of now, there is no evidence of customer information being misused. **Amadeus** has reportedly implemented necessary security measures, and flight operations remain unaffected. ### Broader Industry Impact **Amadeus** is a critical IT firm, providing solutions to over 400 airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels globally. The company had previously published a statement on October 1, 2026, acknowledging a vulnerability in its travel booking display environment that could expose traveler data. While **Amadeus** initially stated that ransomware actors had not exploited the flaw and no payment or financial data was exposed, **JAL's** confirmation suggests malicious exploitation did occur. This incident appears to be part of a broader campaign. Other airlines have also reported customer data breaches tied to the **Amadeus** vulnerability. **All Nippon Airways (ANA)**, a major Japanese carrier, confirmed a similar incident. Additionally, South Korean carriers **Asiana Airlines** and **Korean Air** have acknowledged being affected by the flaw. Investigations are ongoing, and the full extent of the impact across other airlines and markets remains unclear. **Ghost Protocol** has reached out to **Amadeus** for further details on the scope of the compromise and will update this report as more information becomes available. ### The Challenge of Post-Initial Access Security This incident highlights a critical challenge in cybersecurity: even with robust initial access prevention, the security landscape changes dramatically once attackers gain valid credentials. Research indicates that only 37% of attacker actions are blocked after initial access, underscoring the need for advanced detection and response capabilities beyond the perimeter.  This data, from the Blue Report 2026, which analyzes 338 million simulations in production environments, emphasizes that overall prevention scores can mask vulnerabilities in the post-initial access phase. As organizations increasingly rely on third-party vendors, securing these extended perimeters against persistent threats becomes paramount.