Does the report establish an attack lasting three years?

No. A period containing access traces does not establish a continuously active compromise. An assessment should distinguish confirmed access events, available logs and remaining uncertainty.

What should I ask an affected supplier first?

Ask for a mapping to your service and data: which records, data types and periods are confirmed as affected? Also ask about the current state, unresolved investigations and a named contact for further updates.

Does a certificate replace this assessment?

No. A certificate may support part of a supplier review. A specific incident still requires a case-specific response, an assessment of your own exposure and follow-up of outstanding measures.

Japan Airlines: Customer data affected through Amadeus

A supplier processes the data. Your customers still bring their questions to you. Japan Airlines and Japan Transocean Air report unauthorized access to reservation data at Amadeus. The case illustrates why a supplier incident needs a specific account of the data and services affected.

Sources checked on 30 October 2026. This news report is based on the companies’ public statements. Recommendations are our editorial assessment, not findings from our own incident investigation. German is the editorial source version.

What the companies confirm

The JAL notice lists approximately 92,000 affected customers: around 90,000 with reservation and flight data, and another 2,000 with additional details including contact and passport data. Access traces cover 10 August 2023 to 23 September 2026; the airlines were informed on 23 October. JAL says payment card numbers and passwords were unaffected, with no current evidence of misuse or impact on flight operations.

Amadeus confirms a vulnerability in a booking-display environment and implemented safeguards. Its investigation continues; it reports no evidence of payment-data access or ransomware exploitation.

The period does not establish a continuous attack. Nor does the notice mean every person had the same data exposed. Those distinctions matter for a business assessment.

Start with the data relationship

This report does not establish that another business is affected. It does provide a useful question: Could we identify which of our data is held by which service after a similar notice?

A register entry such as “travel provider” or “cloud vendor” does not answer that question. Map the actual service: reservations, billing, HR administration or customer support. Include a business owner, an incident contact and a description of the data processed.

This is not a request to duplicate every detail in another system. The aim is to keep the critical relationships accessible. If a team first has to discover which contract belongs to which application during an incident, it loses time needed for the assessment itself.

What to ask after an incident notice

The following table is our suggested first response to an affected supplier. It contains no additional findings about Amadeus.

Question	What the answer supports
Which service and which of our records are affected?	Bound the internal investigation.
Which data types and periods are confirmed, and which remain uncertain?	Separate evidence from assumptions.
What has been done to stop further access?	Understand the current state.
What evidence or customer-specific information will be supplied?	Support a defensible assessment.
When is the next update, and who is available?	Follow up unresolved issues.

“The vulnerability is fixed” can be relevant to the present technical state. It does not, by itself, answer which data was accessed earlier. Keep containment, assessment of impact and communication with your customers as distinct work items.

Turn the response into a decision

Our recommendation is to record more than the supplier’s email in the incident file. Capture the conclusion: who reviewed it, which systems or people were considered, what remains unresolved and when the next decision is due.

Responsible privacy and legal specialists must assess possible notification duties against the actual facts. A public report alone is insufficient. Keep an incomplete answer visible as an open question rather than turning it into a blanket all-clear.

This is the connection to our car-dealership case and supplier risks: the location of an incident and responsibility towards your own customers are separate matters.

Improve the supplier workflow

Kopexa helps businesses bring supplier assessments, evidence and outstanding measures together. A useful workflow is a documented follow-up after an incident: review the answer, assess the remaining risk and assign an owner to pursue unresolved issues. This does not replace a technical investigation; it makes the organizational consequences actionable.

The decisive question is whether a general supplier notice can become a defensible decision for your business. That requires maintained relationships and specific answers, beyond a security document stored in a folder.