Korean Air has revealed that personal information may have been leaked through a system operated by Amadeus IT Group, a provider of reservation and IT systems.
According to the investigation, unauthorized access was made using credentials assigned to an Amadeus system account. The incident is believed to have occurred between August 2023 and September 2026.
The airline received formal notification from Amadeus at 10:44 p.m. on October 20 (Korea Standard Time) and immediately implemented initial security measures. No evidence of a breach into Korean Air’s internal databases has been found. The company has also reported the matter to relevant South Korean government authorities.
The affected data has been confirmed to include passenger name records (PNRs) for some passengers. Korean Air is verifying other potentially affected items through Amadeus. Individuals known to have been affected have been notified separately by email.
Amadeus has reported that it is implementing corrective measures, including blocking the unauthorized access and beginning dark web monitoring. Korean Air is also working with Amadeus to strengthen security measures and prevent a recurrence.
No secondary damage has been reported at this time. As a precaution, Korean Air advises customers not to click suspicious links, download unknown attachments, or respond to requests for personal information.
