What the Japan Airlines incident teaches organizations about security, backup and recovery

Japan Airlines (JAL) has published an official notice dated October 28, 2026 regarding a cyberattack.

For airlines, transportation providers, manufacturers and other always-on organizations, availability is part of the customer experience. Security controls are essential because preventing or containing an attack can reduce its blast radius. But prevention alone is not a complete resilience strategy. Organizations also need to prepare for the moment when a defensive control is bypassed, a system becomes unavailable or infrastructure must be isolated during containment. 

The reality is backup, recovery and disaster recovery become security outcomes, not merely IT housekeeping. A current backup can preserve data and system state. A tested recovery process can help restore workloads in the required order. Disaster recovery can provide an alternate path for critical systems when the primary environment cannot safely return to service. 

A strong cyber-resilience program connects protection, detection, response and recovery. Acronis guidance emphasizes maintaining multiple encrypted backup copies in separate locations, testing recovery to validate integrity and recovery objectives, scanning backups before restoration, and using immutable storage to make backup deletion more difficult. These controls matter because attackers may target backup archives and recovery tooling as part of an intrusion. 

1. What must stay available? Identify the systems, applications and data whose failure immediately affects customers or operations. Define recovery priorities before an incident, not during one. 

2. Can we recover, not just back up? A successful backup job is not the same as a successful business recovery. Validate that backups are usable and that teams can restore critical services within established recovery objectives. 

3. Can we recover safely? Recovery should not reintroduce malware or restore an environment that remains vulnerable. Include backup integrity checks, malware scanning, patching and clean recovery points in restoration planning. 

The JAL incident is a useful awareness moment because it reinforces a broader resilience principle: cyber incidents can affect the availability of business services. For an airline, service availability is central to operations and the customer experience. The goal of cyber resilience is therefore broader than keeping attackers out. It is maintaining the ability to respond, restore and continue delivering the intended business outcome when disruption occurs. 

For IT and security leaders, the practical takeaway is clear: treat recovery as part of the security architecture. Protect the production environment, protect the backups, document dependencies, test the plan and make sure the organization knows how to operate when primary systems are degraded or unavailable.