Booking reference numbers of Korean Air and Asiana Airlines customers were leaked through the systems of global airline IT company Amadeus. Both carriers said their own systems showed no sign of intrusion, but the exact scale and scope of the leak are still under investigation.
According to the Kyunghyang Shinmun, the two airlines were notified on the night of Oct. 20 by their contractor, Amadeus IT Group, of signs that personal data had leaked through its system, and disclosed it on Oct. 23. Amadeus supplies software to airlines, hotels and travel agencies, and about 200 airlines worldwide use its reservation and ticketing systems.
광고 문의 · 300×250The leak resulted from unauthorized access using login credentials assigned to an account on the Amadeus system. It is believed to have occurred between August 2023 and September this year, with the exact timing still being investigated. So far, the only confirmed leaked item is customers' booking reference numbers.
Airlines say own databases not breached
Korean Air said it took security measures immediately after being notified and found no sign of intrusion into its own systems or databases. It has asked Amadeus for stronger protection and measures to prevent a recurrence, and plans to review all its contractors. It added that no secondary damage had been confirmed so far.
Asiana Airlines said booking-related information had leaked but did not include payment information. It also found no sign of direct intrusion into its internal database and is strengthening security. Amadeus is reportedly blocking unauthorized access and monitoring the dark web.
Both airlines emailed affected customers on the evening of Oct. 23. They urged customers not to click links of unclear origin, download attachments or respond to requests for personal information, and said they will notify customers again if further damage is found. Passengers are advised to watch for phishing that exploits booking numbers.
