When Your Flight Data Leaks: Lessons From This Week's Breaches

Last week's breach headlines carried a lesson for anyone who travels often. In its data breach roundup for 23 to 29 October 2026, Privacy Guides reported that Japan Airlines had disclosed a leak through the Amadeus passenger service system, the booking platform shared by many airlines and travel companies. In the same week, Sony's Japanese internet provider reported a breach of its own.

What leaked

• Japan Airlines: about 92,000 customers had booking codes (PNRs), names, flight dates, routes and travel class exposed; for about 2,000 more, email addresses, phone numbers, passport numbers, nationalities and frequent-flyer numbers were exposed too.
• Sony Network Communications: roughly 2.5 million records, including names, phone numbers, dates of birth and user IDs, plus 54,401 email addresses with account passwords. The breach happened on 19 October and was detected four days later.
• University of Copenhagen: names, national ID (CPR) numbers and contact details of 525,000 people, plus 20,000 PIN codes for building access.

Because Amadeus serves other travel businesses, Privacy Guides expects more companies to make disclosures in the coming weeks.

The most dangerous phishing email is the one that already knows your flight.

The family playbook

None of this calls for panic. It calls for a routine. A booking code, route and date are enough to write a convincing message about a 'change to your flight', and a passport number is a building block for identity fraud.

• Treat any message about a recent or upcoming trip as suspect; open the airline's app or type its address yourself instead of clicking a link.
• Change any password you reused on a breached service, and move email and banking to passkeys or an authenticator app.
• Add a PIN or password to frequent-flyer accounts and check that no miles have moved.
• If an entry PIN leaked at an office, building or school, ask for it to be changed: a door code is a password too.
• Keep scans of every family passport in an encrypted vault, so you can report and replace them quickly.

Regulation is catching up, slowly. The EU's Cyber Resilience Act, in force since November 2024, applies in full from 11 December 2027, setting cybersecurity duties for makers of connected products, with fines of up to €15 million or 2.5% of global turnover. Until then, the routine at home is yours. If you believe your identity has been misused, contact your bank and the relevant authorities, and talk to a qualified professional.