Key points
▶ Personal information belonging to Korean Air and Asiana Airlines customers was exposed at Amadeus, the global aviation IT company that operates the two airlines’ reservation and ticketing systems.
▶ Amadeus notified the two airlines of signs of a data breach at around 10:40 p.m. on October 20. The airlines announced the incident on their websites and emailed customers on October 23.
▶ The incident involved unauthorized access using stolen login credentials for an account on Amadeus’s system. The period of unauthorized access is estimated to have run from August 2023 through September this year.
Customer information from Korean Air and Asiana Airlines has been exposed outside the airlines. On October 20, at around 10:40 p.m., Amadeus IT Group, the global aviation IT company that operates both airlines’ reservation and ticketing systems, notified Korean Air and Asiana Airlines of signs of a personal data breach.
The two airlines announced the breach on their websites and emailed customers on October 23, apologizing for the incident. Amadeus provides reservation and ticketing software to airlines, hotels, and travel agencies, and its systems are used by around 200 airlines.
An account left accessible for more than three years
Investigators believe the incident involved unauthorized access using login credentials assigned to an account on Amadeus’s system. The period of unauthorized access is estimated to have run from August 2023 through September this year. The exact timing of the data exposure is still under investigation. If that estimate is correct, an account was accessed by an outsider for more than three years without anyone noticing until shortly before the airlines were notified.
The only exposed information confirmed so far is airline booking reference codes. These six-character alphanumeric codes are issued when a ticket is booked and are used to view or change a reservation.
Korean Air said, “We have determined that the exposed information included airline booking reference codes,” adding that “the specific information exposed and the number of affected customers have not yet been confirmed.” Asiana Airlines also said that reservation-related information had been exposed.
Payment information was not included in the breach because the two airlines use separate systems to process payments.
Airlines’ systems untouched; breach occurred at an outside vendor
The two airlines said there was no evidence that their own systems or internal databases had been directly compromised. They strengthened security measures immediately after receiving the notification and reported the incident to the Personal Information Protection Commission.
Korean Air said, “We take this incident very seriously and will make every effort to prevent further harm and ensure this does not happen again. We are also asking Amadeus to implement stronger protective measures and develop plans to prevent a recurrence.”
Korean Air also said it would review the practices of vendors entrusted with processing personal information. Amadeus is reportedly blocking unauthorized access and monitoring the dark web for signs that the exposed information is being traded.
No secondary harm has been confirmed so far. However, the airlines warned that the exposed booking reference codes could be used in phishing attempts impersonating the airlines. They urged customers not to open links or attachments from unknown sources and not to respond to messages asking them to provide personal information. Text messages or emails containing a genuine booking reference can easily look authentic.
A shared weak point for airlines: outside IT providers
People in the aviation industry say the incident has exposed a blind spot in airlines’ cybersecurity.
Airlines rely on outside technology providers for critical functions such as reservations, ticketing, and operations, and need to exchange information with them to run their businesses. Because multiple airlines often use the same provider, a breach at one company can expose customers of several airlines at once.
Korean Air and Asiana Airlines received notice of the incident on the same day. Amadeus also experienced a network outage in 2017 that halted passenger check-in at airports around the world.
That is why industry observers say it is not enough for airlines to secure only their own servers; they must also scrutinize the security practices of their technology partners. Korean Air’s plan to review its vendors’ practices is part of that effort. The scale of the breach and whether additional information was exposed will become clear once Amadeus completes its investigation.