Unauthorized access detected at Amadeus IT Group, which operates Korean Air's reservation and ticketing systems
Korean Air's own systems show no signs of compromise
Scope of leak under investigation; airline urges customers to stay vigilant
Signs of a customer data breach have emerged at a third-party vendor that operates Korean Air's flight reservation and ticketing systems. Booking confirmation numbers belonging to Korean Air customers are among the information believed to have been exposed.
According to the aviation industry on Friday, Korean Air received notification from global aviation IT firm Amadeus IT Group late Tuesday of a suspected personal data leak.
Amadeus is a global IT company that supplies reservation, ticketing and other software to airlines, hotels, travel agencies and other travel-related businesses.
The incident is believed to have resulted from unauthorized access using login credentials for an Amadeus system account. The breach is estimated to have occurred sometime between August 2023 and last month, though the exact timeframe remains under investigation.
Korean Air said it immediately implemented necessary security measures upon receiving the notification. No evidence has been found so far that the airline's own systems or databases were compromised.
However, it has been confirmed that booking numbers of Korean Air customers were included in the personal data exposed through the Amadeus system. The full scale of the leak and any additional categories of personal information have yet to be determined, with Amadeus conducting its own investigation.
The incident has drawn attention because the customer data was exposed through an external IT vendor rather than systems directly managed by the airline. Because flight reservation and ticketing operations are frequently linked to outside systems, account management and access controls at third-party vendors are considered just as critical to protecting personal data as the airline's own internal security.
Korean Air sent an email to affected customers on Friday notifying them of the breach and offering an apology. The airline said it will issue further notifications if additional leaked information is identified.
Korean Air urged customers to "take caution not to click on links of unknown origin, download attachments, or respond to requests for personal information, so as to prevent secondary harm."
Amadeus is also taking follow-up steps, including blocking the unauthorized access and activating dark web monitoring.
"We recognize the gravity of this situation and plan to devote all efforts to preventing further damage and ensuring it does not happen again," Korean Air said, adding that it is also demanding that Amadeus implement stronger protective measures and steps to prevent a recurrence.
Korean Air also plans to conduct a comprehensive review of all external vendors and strengthen personal data protection measures across the board.
boo@heraldcorp.com
