The news. Japan Airlines says a breach at Amadeus's passenger service system exposed the data of about 92,000 customers. For about 90,000 of them that means reservation codes, names, flight dates, routes and travel classes. A further 2,000 had more exposed: email addresses, phone numbers, passport numbers, nationalities and frequent-flyer numbers. JAL says card numbers and passwords were not taken, and that it has no evidence of misuse so far. Cathay Pacific puts its figure at about 53,000 bookings, and ANA, Asiana and Korean Air have also confirmed impact. Both reports describe an access window of more than three years.
On the hotel side, German media are again reporting Norton's research on what it calls Reservation Hijack. Norton's parent Gen counted more than 350 compromised accommodations across 50 countries, 49 of them in Germany. A guest gets a message with the right hotel and the right trip, and a link to pay. Booking.com told customers that reservation details had been accessed, and said financial information was not accessed from its systems.
What these stories do and do not say
The second story is easy to misread. Gen says the source of compromise "may vary": a hotel account, a platform partner account, an inbox, a property system, or a service provider. It does not say one platform lost 350 hotels. It has not published the names, and a Berlin consumer forum quoted in the German coverage says the hacks are not proven.
What joins the two stories is simpler. In both, the data sat with a company the traveller never chose to think about, and an agency may be the last to hear.
A booking does not live in one place
On the desks I ran we knew more than 4,400 partner companies by name. That is the real shape of this trade. One trip passes through many hands, and each hand keeps a copy of something.
So three things are worth doing this week. Ask each provider directly whether your bookings are affected, and get the answer in writing. Tell clients now that a real hotel name and real dates in a message prove nothing, and that any new payment request gets checked by phone first. And brief your own staff: Gen says the lures aimed at hotel teams look like normal work, such as a guest complaint or an urgent reservation check.
Then write the list you probably do not have. For each system: what client data sits in it, who runs it, and who tells you when something goes wrong.
If a provider emailed you tonight about exposed bookings, could you name the affected clients by morning?
Sources: BleepingComputer — Japan Airlines suffers third-party data breach · The Straits Times — Cathay Pacific joins growing list of airlines hit by data breach · Gen — When Hotel Scams Know Your Booking · Heidelberg24 — 49 German accommodations.