Global Airlines (Top 40) · Airline (Asia, legacy) · Data breach
Japan Airlines (JAL)
Headline
JAL was part of the 2021 SITA multi-airline breach that also reached Finnair, SAS, Singapore Airlines and Air India.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
JAL was part of the 2021 SITA multi-airline breach that also reached Finnair, SAS, Singapore Airlines and Air India. The row's value in this tracker is comparative rather than dramatic: JAL and ANA are direct competitors in the same country under the same privacy law, one appears in the SITA cluster and one does not, and the difference came down to which aviation IT vendor each had contracted with rather than to any security decision a passenger could observe or evaluate before booking.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — Japan's Act on the Protection of Personal Information (APPI) applies domestically; GDPR applies for EU passengers.
Data sharing
SAME 2021 SITA MULTI-AIRLINE BREACH as Singapore Airlines/Finnair (see those rows). SEPARATELY, a MORE RECENT, DISTINCT incident (Feb 2026): JAL initially announced (Feb. 10, 2026) suspected unauthorized access at about 00:40 on Feb. 9 to its 'Same-Day Baggage Delivery Service' reservation system, potentially affecting up to 28,000 users, and suspended the service. On Feb. 17, 2026 JAL said its investigation found no outside attack and no external leak of customer data: a contractor employee had accidentally deleted data during maintenance and then deleted or altered access logs to conceal it. The roughly 28,000 users were notified and the service resumed Feb. 20, 2026. This is a vendor-integrity incident, not a confirmed data breach.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy jal.co.jp/jp/en/other/privacy_policy/ | Not fetched yet | NO (HTML only) |
| Terms of service jal.co.jp/jp/en/other/conditions_of_carriage/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.