INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Korean Air Leaks Customer Information

| 2026-10-23 12:10 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
Korean Air has confirmed a data breach incident occurred when a customer's flight reservation number was leaked through an external third-party service, specifically Amadeus IT Group. The airline received a notification on 20th of September regarding a potential data leak and announced the incident on 23rd of September. The incident is believed to have occurred due to unauthorized access to Amadeus IT Group's system accounts using login credentials, resulting in an estimated leak between August 2023 and this year. Korean Air has taken necessary safety measures immediately after the notification and confirmed no unauthorized access in its own systems. Amadeus IT Group is conducting measures such as unauthorized access blocking and dark web monitoring to mitigate the incident.
Technical Mitigations AI-generated
• Block unauthorized access to Amadeus IT Group's system accounts using login credentials. • Conduct dark web monitoring for leaked customer flight reservation numbers. • Review and request additional security measures from the third-party service used by Korean Air.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope aviationaviation hospitalityhospitality
Incident Timeline
‎August 2023
Threat actors used social engineering tactics to target Korean Air employees, resulting in the unauthorized disclosure of customer information between August 2023 and September this year.
‎20th of September
Amadeus IT Group notified Korean Air on September 20th about a potential data leak.
tactic Data Leak
Korean Air received a notification from Amadeus IT Group, a global airline IT system operator, on 20th of September regarding a potential data leak.
organisation Amadeus IT Group
Korean Air received a notification from Amadeus IT Group, a global airline IT system operator, on 20th of September regarding a potential data leak.
‎23rd of September
Korean Air announced on September 23rd that it had leaked customer information.
‎2026/10/23
Threat actors used compromised login credentials to gain unauthorized access to Amadeus IT Group's system accounts, resulting in the leakage of customer information through an external third-party service.
organisation Korean Air
Korean Air, a cooperating partner, has leaked customer information...
organisation Amadeus IT Group's
The incident is believed to have occurred due to unauthorized access to Amadeus IT Group's system accounts using login credentials.
Intelligence Sources
Chosun Economy 2026-10-23