Jin Air, the Korean low-cost carrier, says an outside attacker used the system it uses to look up member information to pull personal data on 1,454 members. In a notice on its website on 29 October, the airline said it had "confirmed signs of abnormal external access to its internal systems." Seoul Economic Daily, The Herald Business and The Asia Business Daily all report the same figure of 1,454 members from that notice, and no outlet gives a different count. The exposed data includes member IDs, names, dates of birth and mobile numbers. Jin Air says passwords, financial information and payment records were not taken. Jin Air belongs to Hanjin Group, the same group as Korean Air and Asiana Airlines. This is a separate incident from the Amadeus booking-system breach those two airlines disclosed on 20 October. It is also separate from the 22 October breach at the group's IT company, Hanjin Information Systems & Telecommunications, and from the passenger database found exposed in Vietnam. Nothing published so far links this incident to any of them.
What Happened
Jin Air says it confirmed the attack on 28 October and published its notice the next day. According to the airline, the attack "targeted the application programming interface (API) used to look up member information." Its first steps were to block the attacking IP addresses, report the breach to Korea's Personal Information Protection Commission (PIPC), cut off all access to the system it identified as the entry point, and then delete that system entirely. It also says it has reviewed security and vulnerabilities across the company and switched on 24-hour emergency monitoring.
The investigation is still going on. Jin Air says it has found no fraudulent use of the data so far. It has not said when the unauthorised access began, how long it lasted before it was detected, or whether the attacker took data in one session or over a longer period. All of the reporting traces back to Jin Air's own website notice. No PIPC findings or Korea Internet & Security Agency (KISA) statement on this incident had been published at the time of writing.
How this differs from other recent Hanjin Group incidents:
- Korean Air and Asiana (Amadeus): On 20 October, Amadeus, which handles reservations and ticketing for both airlines, told them that someone had used valid login credentials for an account on its system to get in without authorisation. The Asia Business Daily and Maeil Business Newspaper report that booking reference numbers were exposed, over a period estimated at August 2023 to September 2026. Both airlines say their own systems show no sign of a breach. This was a vendor-side breach. Jin Air's incident involves its own member lookup API.
- Hanjin Information Systems & Telecommunications: The group's IT company says that on 22 October it found that an attacker had accessed its IT service management (ITSM) portal, the site used for fault reports and maintenance requests, and viewed the names and email addresses of 980 users. Maeil Business Newspaper reports that a hacking group claiming responsibility says it took 999 staff account records, details of which staff are placed at major clients, and partner-company accounts. The company has not confirmed those claims. Neither company has said the ITSM breach is connected to Jin Air's.
- Vietnam passenger database: Hankyoreh reported on 22 October that the research group Kinryu Labs found a Vietnamese database open to the internet holding more than 220 million traveller records from 2017 to April 2026. Nearly 25 million of those records (24,803,512 by Hankyoreh's Japanese-language count) belong to passengers of five Korean airlines, Jin Air among them. "API" there means Advanced Passenger Information, the passenger details airlines send to destination countries before a flight. It has nothing to do with the web API attacked at Jin Air. Vietnamese authorities have not confirmed that any data was taken.
What Was Taken
Jin Air lists these exposed fields for each of the 1,454 affected members:
- Member ID (login username)
- Name
- Date of birth
- Gender
- Nationality
- Mobile phone number
- Email address
- Date and time of most recent login
According to Jin Air, passwords, financial information and payment records were not exposed. The number of people affected is small. The data, though, is a complete identity profile: a login username together with a verified phone number and email address. That is exactly what an attacker needs to send convincing fake messages pretending to be the airline, or to try passwords leaked from other sites against these accounts. The last-login timestamp also shows which accounts are in active use, which helps an attacker decide who to target first.
Why It Matters
This is the fourth incident in about ten days involving Hanjin Group airlines, their vendors or their IT company. Taken together, Korean press coverage describes a pattern of attackers going after the surrounding systems: vendors, maintenance portals and service interfaces rather than the main databases. Maeil Business Newspaper describes it as attackers hitting the "weak links" of outside and secondary systems as a route into larger networks. Jin Air's case fits that pattern. The weak point was a lookup interface, which Jin Air could delete outright after the attack. That suggests it was not a core business system.
There is also a risk of the incidents adding up for customers. Korean travellers may now have booking reference numbers exposed through Amadeus, passport and flight details sitting in an open Vietnamese database, and, for this group of Jin Air members, account IDs and contact details. No one has shown these datasets have been combined. Fraudsters, however, benefit from exactly this kind of cross-referencing. The Asia Business Daily notes that scammers who seem to know real booking details make refund, rebooking or extra-payment scams far more believable.
The Attack Technique
Jin Air has described only the target: an API used to look up member information. It has not said whether the attacker took advantage of missing authorisation checks, used stolen credentials, or ran an automated script to work through member records one at a time. Leaks of 1,454 records containing identical fields through a lookup endpoint often point to an access-control flaw, where the API returns one user's data to a caller who should not be allowed to see it. That is an analyst's inference, not something Jin Air has confirmed. The airline has not named a threat actor, and no group has publicly claimed the attack.
Blocking the attacking IP addresses and then removing the whole system suggests Jin Air found that endpoint could not be fixed quickly, or was no longer needed. Either way, it was reachable from the internet and attackers found it.
What Organizations Should Do
- List and audit every API that returns personal data. That includes old, internal-only and partner endpoints. Check that every request is authorised for the specific record it asks for, not just that the caller is logged in.
- Limit request rates and watch for record-by-record harvesting. Alert when a single client requests many different member IDs in sequence, especially from IP addresses not linked to real user sessions.
- Return less data. A lookup endpoint seldom needs to send back date of birth, nationality and last-login time together. Remove fields the calling application does not use.
- Decommission systems that are no longer needed. If an endpoint can be deleted after a breach without disrupting the business, it probably should have been removed earlier. Review internet-facing assets regularly.
- Prepare affected customers for phishing and password-reuse attacks. Tell them directly that the airline will not ask for passwords or payment details by text or email. Consider forcing password resets or extra verification for exposed accounts, since their usernames are now known.
- Treat vendor and affiliate breaches as your own risk. Where IT services, maintenance portals or booking platforms are shared within a corporate group, reset shared credentials, give partner accounts only the access they need, and watch for logins from unusual devices or locations.
Sources: Jin Air Says Data of 1,454 Members Leaked in External Attack - Seou... | Jin Air hack exposes personal data of 1,454 members - The Herald Bu... | Data leak in Vietnam exposes 9 years of Korean airline passenger re... | ベトナムで韓国航空会社の旅行記録２千万件強が露出…９年分の乗客のパスポート番号も（ハンギョレ新聞） - Yahoo!ニュース | 뉴스룸 한진정보통신 | 외부 시스템 '약한고리' 타격…항공·물류 전산망 본체 파고든다 - 매일경제 | Airline Booking Data Leaked, Ships Also Threatened... Companies Rea... | Jin Air Members' Personal Information Leaked in Hacking Attack; 1,4...