Korean Air, Asiana Airlines suffer customer data breach through shared booking system

Customer data breaches have been detected at both Korean Air and Asiana Airlines, stemming from a security incident at a third-party reservation and ticketing system shared by the two carriers. The full extent of the damage has yet to be determined.

According to aviation industry sources, Korean Air and Asiana Airlines were notified Tuesday night by global aviation IT firm Amadeus IT Group of the suspected leak of customer personal information.

Amadeus is a global IT company that supplies reservation and ticketing software to airlines, hotels and travel agencies. Both Korean Air and Asiana Airlines, along with numerous other international carriers, use the company's systems.

The incident is believed to have resulted from unauthorized access using login credentials for Amadeus system accounts. The breach is estimated to have occurred between August 2023 and last month, though the exact timeline remains under investigation.

Both airlines moved to strengthen security measures immediately after receiving notification. No evidence has so far been found of direct intrusion into either carrier's own systems or internal databases.

However, customer information is believed to have been exposed through the third-party operator's system. Korean Air has confirmed that customer reservation numbers were among the leaked data. The total scope of the breach and any additional categories of personal information involved have not yet been determined.

Asiana Airlines said reservation-related information had been leaked through the Amadeus system. The airline added that payment-related information was not among the data exposed, as ticket payments are processed through a separate system.

The incident has drawn attention to security management of outsourced vendors in the aviation industry, given that it originated in an external IT system shared by both carriers. Because airline reservation and ticketing operations require information exchange between carriers and external systems, account management and access controls at third-party operators are considered critical components of personal data protection.

Amadeus is currently investigating the specific circumstances of the breach and the full scope of the damage.