Korean Air breach exposes blind spot in airline cybersecurity

Korean Air and Asiana Airlines said last week that customer reservation information was exposed through Amadeus IT Group, a global provider of airline reservation and ticketing systems. The breach is believed to have involved unauthorized access using account login credentials, with an estimated incident window from August 2023 to last month. The airlines said they found no evidence that their own internal systems or databases were breached and activated security measures after notification. The incident highlights the shared cybersecurity risks created by airlines’ reliance on external technology providers.

Korean Air confirmed that some exposed information included customers’ booking reference numbers, while the full scope and number of affected customers remained under investigation.

Asiana said payment data was not affected because it uses a separate system for transactions.

The airlines said Amadeus notified them of the incident on Tuesday, and that it was blocking unauthorized access and monitoring the dark web.

Korean Air said it had requested stronger safeguards and measures from Amadeus to prevent further issues.

A technical network failure affecting Amadeus systems in 2017 disrupted airport check-in services worldwide.

Published Oct 25, 2026 3:46 pm KST

Updated Oct 25, 2026 5:29 pm KST

Airlines face persistent risks from third-party IT partners

A Korean Air jet taxis along the runway at Incheon International Airport, Aug. 18. Korea Times photo by Shim Hyun-chul

A recent data breach involving Korean Air and Asiana Airlines demonstrates the aviation industry’s structural vulnerability to cyberattacks targeting third-party IT providers.

Carriers depend on external IT system operators to manage critical operations, as they have to share passenger booking and ticketing data with external partners for real-time global operation.

Last week, Korean Air and Asiana said customer reservation information had been leaked through Amadeus IT Group, a global aviation technology provider that operates reservation and ticketing systems for airlines worldwide.

The two carriers said Amadeus had notified them of the incident on Tuesday. The breach is believed to have involved unauthorized access using login credentials assigned to an account in Amadeus' system. The estimated incident window spans August 2023 to last month, although investigators have yet to establish the exact timing.

Korean Air confirmed that some customers' booking reference numbers were among the exposed information, while the full scope of the leak and the number of affected customers remained under investigation.

A Korean Air plane in flight / Courtesy of Korean Air

Asiana also confirmed that reservation-related information had been compromised, but said payment data was not affected because it uses a separate system for transactions.

Neither airline has found evidence of a direct breach of its own internal systems or databases, they said. They activated security measures after being notified and are working to prevent further damage. Amadeus is also blocking unauthorized access and monitoring the dark web, according to the airlines.

Industry officials said the incident shows how difficult it is for airlines to eliminate cybersecurity risks stemming from third-party providers in an industry that relies heavily on information sharing.

Airlines must exchange booking, ticketing and passenger information with travel agencies, partner carriers and other service providers to operate international routes and manage customer itineraries.

Building and maintaining all the necessary systems and connections independently would require substantial investment and technical resources.

Global providers such as Amadeus offer established platforms that connect airlines with the wider travel ecosystem. But when multiple carriers rely on the same provider, a security incident at that company can potentially affect customers across different airlines, creating a shared point of vulnerability.

The incident also underscores the importance of airlines monitoring the security practices of their tech partners, rather than relying solely on their own cybersecurity measures.

“Airlines face structural cybersecurity risks because they rely on external technology providers for stable operations,” an industry official said.

Korean Air said it had requested stronger safeguards and measures to prevent further issues from Amadeus. In 2017, a technical network failure affecting Amadeus systems disrupted check-in services at airports worldwide, demonstrating how problems at a shared provider can affect multiple carriers.

Korean Air faces maintenance capacity crunch from Asiana acquisition

Korean Air faces probe over deleted documents in route case

大韩航空和韩亚航空上周表示，由于全球航空公司订票系统供应商Amadeus IT Group的缘故，客户订票信息遭到泄露。据信，此次泄露事件涉及未经授权的账户登录凭证访问，事件发生时间估计在2023年8月至上个月之间。两家航空公司表示，他们没有发现自身内部系统或数据库遭到入侵的证据，并在接到通知后立即启动了安全措施。此次事件凸显了航空公司对外部技术供应商的依赖所带来的网络安全风险。

大韩航空证实，部分泄露信息包括客户的预订参考编号，但受影响客户的全部范围和人数仍在调查中。

韩亚航空表示，由于其交易采用独立系统，因此支付数据未受影响。

航空公司表示，Amadeus 于周二通知了他们这一事件，并表示正在阻止未经授权的访问并监控暗网。

大韩航空表示，已要求Amadeus公司采取更强有力的保障措施，以防止出现进一步的问题。

2017 年，Amadeus 系统发生技术网络故障，导致全球机场值机服务中断。

发布于2026年10月25日下午3:46（韩国标准时间）

更新于2026年10月25日下午5:29（韩国标准时间）

航空公司面临着来自第三方IT合作伙伴的持续风险。

8月18日，一架大韩航空的飞机在仁川国际机场的跑道上滑行。韩国时报摄影师沈贤哲摄

最近大韩航空和韩亚航空的数据泄露事件表明，航空业在针对第三方 IT 提供商的网络攻击方面存在结构性脆弱性。

航空公司依赖外部 IT 系统运营商来管理关键运营，因为他们必须与外部合作伙伴共享乘客预订和票务数据，以实现实时全球运营。

上周，大韩航空和韩亚航空表示，客户预订信息通过 Amadeus IT Group 泄露，Ama​​deus IT Group 是一家全球航空技术提供商，为世界各地的航空公司运营预订和票务系统。

两家运营商表示，Amadeus公司已于周二通知他们发生了这起事件。据信，此次安全漏洞涉及未经授权的访问，攻击者使用了分配给Amadeus系统账户的登录凭证。事件发生时间估计在2023年8月至上个月之间，但调查人员尚未确定确切时间。

大韩航空证实，部分客户的预订参考编号包含在泄露的信息中，但泄露事件的全部范围和受影响的客户人数仍在调查中。

一架正在飞行中的大韩航空飞机 / 图片由大韩航空提供

韩亚航空也证实，与预订相关的信息已被泄露，但表示支付数据未受影响，因为该公司使用单独的交易系统。

两家航空公司均表示，尚未发现其内部系统或数据库遭到直接入侵的证据。接到通知后，他们已启动安全措施，并正在努力防止进一步损失。据航空公司称，Amadeus 也在阻止未经授权的访问，并监控暗网。

业内人士表示，该事件表明，在一个高度依赖信息共享的行业中，航空公司要消除来自第三方供应商的网络安全风险是多么困难。

航空公司必须与旅行社、合作伙伴航空公司和其他服务提供商交换预订、票务和乘客信息，才能运营国际航线和管理客户行程。

独立构建和维护所有必要的系统和连接需要大量的投资和技术资源。

像 Amadeus 这样的全球供应商提供成熟的平台，将航空公司与更广泛的旅游生态系统连接起来。但是，当多家航空公司依赖同一供应商时，该公司发生的安全事件可能会影响不同航空公司的客户，从而造成共同的安全漏洞。

该事件也凸显了航空公司监控其技术合作伙伴的安全措施的重要性，而不是仅仅依赖自身的网络安全措施。

一位业内人士表示：“航空公司面临结构性网络安全风险，因为它们依赖外部技术提供商来维持稳定的运营。”

大韩航空表示，已要求Amadeus采取更强有力的保障措施，以防止再次出现问题。2017年，Amadeus系统发生的技术网络故障导致全球多个机场的值机服务中断，这表明同一服务提供商的问题可能会影响多家航空公司。

大韩航空因收购韩亚航空而面临维修能力短缺。

大韩航空因航线案件中文件删除一事面临调查