--- title: What the Japan Airlines incident teaches organizations about security, backup and recovery description: "Japan Airlines (JAL) has published an official notice less than one week ago about a recent cyberattack. But prevention alone is not a complete resilience strategy. The reality is backup, recovery and disaster recovery become security outcomes, not merely IT housekeeping. or IT and security leaders, the practical takeaway is clear: Treat recovery as part of the security architecture." canonical_url: https://www.acronis.com/en/blog/posts/what-the-japan-airlines-incident-teaches-organizations-about-security-backup-and-recovery/ locale: en last_updated: 2026-10-29 --- [Acronis Blog](https://www.acronis.com/en/blog/) # What the Japan Airlines incident teaches organizations about security, backup and recovery Japan Airlines (JAL) has published an official notice less than one week ago about a recent cyberattack. But prevention alone is not a complete resilience strategy. The reality is backup, recovery and disaster recovery become security outcomes, not merely IT housekeeping. or IT and security leaders, the practical takeaway is clear: Treat recovery as part of the security architecture. [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 2 min read Last updated 29 October 2026 ## The real lesson is operational resilience Japan Airlines (JAL) has published an [official notice](https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html) dated October 28, 2026 regarding a cyberattack. For airlines, transportation providers, manufacturers and other always-on organizations, availability is part of the customer experience. Security controls are essential because preventing or containing an attack can reduce its blast radius. But prevention alone is not a complete resilience strategy. Organizations also need to prepare for the moment when a defensive control is bypassed, a system becomes unavailable or infrastructure must be isolated during containment. The reality is backup, recovery and disaster recovery become security outcomes, not merely IT housekeeping. A current backup can preserve data and system state. A tested recovery process can help restore workloads in the required order. Disaster recovery can provide an alternate path for critical systems when the primary environment cannot safely return to service. ## Security must extend through recovery A strong cyber-resilience program connects protection, detection, response and recovery. Acronis guidance emphasizes maintaining multiple encrypted backup copies in separate locations, testing recovery to validate integrity and recovery objectives, scanning backups before restoration, and using immutable storage to make backup deletion more difficult. These controls matter because attackers may target backup archives and recovery tooling as part of an intrusion. ## Three questions every organization should ask **1. What must stay available?**Identify the systems, applications and data whose failure immediately affects customers or operations. Define recovery priorities before an incident, not during one. **2. Can we recover, not just back up?**A successful backup job is not the same as a successful business recovery. Validate that backups are usable and that teams can restore critical services within established recovery objectives. **3. Can we recover safely?**Recovery should not reintroduce malware or restore an environment that remains vulnerable. Include backup integrity checks, malware scanning, patching and clean recovery points in restoration planning. ## From cyber defense to cyber resilience The JAL incident is a useful awareness moment because it reinforces a broader resilience principle: cyber incidents can affect the availability of business services. For an airline, service availability is central to operations and the customer experience. The goal of cyber resilience is therefore broader than keeping attackers out. It is maintaining the ability to respond, restore and continue delivering the intended business outcome when disruption occurs. For IT and security leaders, the practical takeaway is clear: treat recovery as part of the security architecture. Protect the production environment, protect the backups, document dependencies, test the plan and make sure the organization knows how to operate when primary systems are degraded or unavailable. [Cyberthreats](https://www.acronis.com/en/blog/tags/cyberthreats/) [Data protection](https://www.acronis.com/en/blog/tags/data-protection/) [Disaster recovery](https://www.acronis.com/en/blog/tags/disaster-recovery/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/the-critical-importance-of-creating-secure-passwords/) [The critical importance of creating secure passwords](https://www.acronis.com/en/blog/posts/the-critical-importance-of-creating-secure-passwords/) [Next post](https://www.acronis.com/en/blog/posts/cyberattacks-hit-grocery-retail/) [Cyberattacks hit grocery retail, exposing supply chain risk](https://www.acronis.com/en/blog/posts/cyberattacks-hit-grocery-retail/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: Attackers don’t need costumes when they can log in to Microsoft 365](https://staticfiles.acronis.com/images/blog-card/921f0c5048555666a978ad0c5cf76f18.png) [Attackers don’t need costumes when they can log in to Microsoft 365](https://www.acronis.com/en/blog/posts/attackers-dont-need-costumes-when-they-can-log-in-to-microsoft-365/) Halloween is full of disguises, but a cyberattacker doesn't need a costume to get inside a Microsoft 365 environment. Protecting that access starts with the identities and settings behind it. Microsoft Entra ID governs who can access Microsoft 365 and connected SaaS applications. **October 29, 2026**4 min read ![Image 5: Law firms face rising cyber risk as attackers adopt AI](https://staticfiles.acronis.com/images/blog-card/8bb6bdaf6925ec94f31d5b787de10ef6.png) [Law firms face rising cyber risk as attackers adopt AI](https://www.acronis.com/en/blog/posts/law-firms-face-a-rising-cyber-risk-as-attackers-adopt-ai/) Reports of cyberattacks targeting law firms highlight risks to confidential client data as attackers use AI to sharpen phishing and impersonation tactics. Learn six steps to reinforce protection. **October 28, 2026**3 min read ![Image 6: When a $1 million hacker bounty becomes a cybersecurity warning](https://staticfiles.acronis.com/images/blog-card/7ffac42270bc3d64be95e346938830cc.png) [When a $1 million hacker bounty becomes a cybersecurity warning](https://www.acronis.com/en/blog/posts/when-a-one-million-hacker-bounty-becomes-a-cybersecurity-warning/) A reported $1 million reward for information that could identify an alleged hacker is the kind of number that grabs attention. But the more important story for security teams is what sits behind the headline: attackers continue to pursue access to financial accounts, identities and credentials, and organizations need defenses that assume those attacks will keep coming. **October 28, 2026**2 min read