Personal Data Leaked from Korean Air and Asiana in Incident at Reservation-System Partner [Roundup]

[Financial News] Customer personal information from Korean Air and Asiana Airlines was confirmed to have been leaked through an external partner that operates reservation and ticketing systems. A security incident at the global airline IT provider used by both companies led to the leak of customers’ booking-related information. However, no signs of a direct leak from either airline’s internal data have reportedly been found.
According to the airline industry on the 23rd, Korean Air was notified by Amadeus IT Group (Amadeus) on the night of the 20th of signs of a personal data leak. Amadeus is a global IT company that provides reservation and ticketing software to airlines, travel agencies and hotels.
The incident is believed to have resulted from unauthorized access using login credentials for accounts in Amadeus’s system. The incident is believed to have occurred sometime between August 2023 and last September, but the specific timing and circumstances of the breach are under investigation. In Korean Air’s case, customer reservation numbers were confirmed to be among the leaked personal information. However, the overall scale of the leak and the specific types of personal information involved have not yet been determined. Amadeus is investigating the circumstances of the incident and the extent of the damage.
Korean Air said it took the necessary security measures immediately after being notified of the incident, and that there were no signs its own systems or databases (DB) had been directly breached. The airline sent customers an email that day informing them of the personal data leak and apologizing. It plans to provide further information if additional investigation confirms specific details of the leak. It also urged customers not to open URLs or attachments from unclear sources and to be wary of suspicious communications requesting personal information. Amadeus is also reportedly taking follow-up measures, including blocking unauthorized access and monitoring the dark web.
Korean Air said it takes the matter seriously and will devote every effort to preventing further harm and a recurrence. It also plans to call on Amadeus to strengthen security and develop measures to prevent a recurrence, and to review the practices of all companies entrusted with processing personal information.
Booking-related personal information was also confirmed to have been leaked from Asiana Airlines, which uses the same company’s system. However, payment-related information was not among the leaked data, according to the findings.
A spokesperson for Asiana Airlines said, “It was confirmed that booking-related information was leaked as a result of the data leak at Amadeus, the operator of a global airline IT system, but payment-related information was not included,” and added, “There are no signs of a direct breach of our internal database, but we are implementing measures to strengthen security. We will make every effort necessary to protect customers’ personal information and prevent further harm and a recurrence.”



[email protected] Jung Won-il Reporter