Korean Air and Asiana Airlines have confirmed that customer personal information leaked from systems run by Amadeus IT Group, the global aviation IT provider that processes data on their behalf. Both carriers say someone gained unauthorized access using login credentials assigned to an account in Amadeus's system. The exposure is estimated to have run from August 2023 to September 2026, though the airlines say the exact timing is still under investigation (The Asia Business Daily; Korean Air's customer notification as quoted by MoneyToday). Neither airline found signs that its own systems were breached. Neither has disclosed how many customers are affected, and none of the available sources give a record count.
What Happened
Korean Air says Amadeus formally notified it at about 10:44 p.m. KST on October 20, 2026. The airline says it took security measures right away and confirmed there were no signs of intrusion into its own database (Korean Air notification via MoneyToday; The Asia Business Daily). By October 23, Korean Air had begun notifying affected customers directly. MoneyToday describes Amadeus as a "trustee" of the airline, meaning a contracted data processor under Korean privacy law.
Asiana Airlines confirmed separately that reservation-related information was leaked in the Amadeus breach. It also said there were no signs of a direct breach of its internal database (The Asia Business Daily).
The airlines say Amadeus is blocking the unauthorized access and monitoring the dark web. Korean Air says it is pressing Amadeus for "stronger protective measures and steps to prevent a recurrence." Amadeus has not issued a statement in any of the sources reviewed for this brief, and no regulator filing is cited. Every account here traces back to statements the airlines made to the Korean press.
The incident comes at a sensitive moment. Asiana is due to be absorbed into Korean Air on December 17, 2026, and has already notified customers that their personal data will be transferred to Korean Air (Asiana merger notice). After the merger, a single company will hold both customer bases, along with the remediation and notification duties for this incident.
What Was Taken
- Korean Air: reservation numbers and other personal information, per the airline's customer notification (MoneyToday). The full list of fields is cut off in the available reporting.
- Asiana Airlines: reservation-related information. Asiana states that payment information was not included (The Asia Business Daily).
- Volume: not disclosed by either airline.
A different, unrelated exposure has also been in the news, and the two should not be confused. In June 2026, Kinryū Labs found an unsecured Elasticsearch cluster called "pax-info" in Viettel IP space in Hanoi. It held about 220.8 million Advance Passenger Information System (APIS) records covering January 2017 to April 2026, with names, dates of birth, nationalities and passport numbers (GeekFeed). The Hankyoreh reports that nearly 25 million of those records belong to passengers of five Korean carriers, including Korean Air and Asiana. Vietnamese authorities have said the leak is "unconfirmed." None of the sources link that APIS exposure to the Amadeus incident. The cause, the data types and the custodian are all different, and the 25 million figure should not be read as the size of the Amadeus breach.
Why It Matters
Third-party processors are now the main way in. The airlines' own systems held up, but an attacker who logged into the vendor's system got the same customer data anyway. Seoul has seen the same pattern weeks earlier. Between September 28 and October 3, 2026, attackers breached Shinhan, KB Kookmin and Hana banks through peripheral and partner-facing systems rather than core banking networks (The Asia Business Daily, October 6).
Dwell time may have been very long. If the estimated window is accurate, someone with valid credentials had access for up to about three years without being noticed. That points to a lack of behavioral monitoring on vendor accounts.
Breaches at shared platforms rarely stay with one customer. Amadeus provides reservation and departure-control systems to hundreds of airlines. The available reporting confirms only Korean Air and Asiana as affected. Whether other Amadeus customers were exposed through the same account or method has not been disclosed.
Aviation is a busy target right now. AhnLab's ASEC weekly dark-web bulletin for the second week of September 2026 listed leak-site activity against transport and aviation operators in South Korea and three other countries, naming groups including AuditTeam and Lapsus (vpn.social). Separately, Anthropic's September 2026 Threat Intelligence Report described suspected ShinyHunters affiliates using stolen credentials to reach tens of millions of passenger records at an unnamed airline (ynews.digital). No source connects either item to this incident. We include them only as context on how attackers are going after the sector.
The Attack Technique
The only technical detail confirmed so far is that the intruder used legitimate login credentials assigned to an account in Amadeus's system. That is the airlines' wording, as carried by both The Asia Business Daily and MoneyToday.
Several things remain undisclosed: - whether the account belonged to an airline user, an Amadeus employee or an integration/service identity - how the credentials were obtained (phishing, infostealer malware, reuse, or a secret exposed in code or an app) - whether multi-factor authentication was enforced on the account - whether any threat actor has claimed the data
Taken together, the valid-account access, the lack of any reported exploit, and the long estimated window fit credential-based intrusion (MITRE ATT&CK T1078, Valid Accounts) rather than exploitation of a software flaw. Anthropic's report describes harvesting credentials at scale from decompiled Android apps and leaked GitHub tokens, which shows how such credentials circulate in the sector. That is still a general observation, not evidence of how this particular account was compromised.
What Organizations Should Do
- List every vendor account that can reach your customer data. That includes accounts your staff use on vendor platforms (GDS, PSS, CRM, SaaS). Require phishing-resistant MFA on all of them, and require that vendors enforce it on their own accounts that touch your tenant.
- Get vendor access logs and alert on them yourself. Write into contracts that processors send authentication and data-access telemetry to your SIEM. Watch for unusual query volume, logins at odd hours, new IP ranges or ASNs, and bulk exports of PNR data.
- Rotate and limit credentials on a schedule. Expire long-lived service passwords and API tokens, scope each one to least privilege, and scan your own apps and code repositories for embedded secrets before attackers do.
- Put notification deadlines into processor contracts. Require notice within a fixed number of hours, regular investigation updates, and the right to an independent forensic review. Reporting a three-year window after the fact suggests detection controls failed somewhere.
- Assume reservation data will be used for phishing. Booking references, names and itineraries make convincing lures. Warn customers in advance, and watch for lookalike domains and fake "rebooking" or "refund" messages.
- Plan security work around the merger. When customer data is consolidated, as Korean Air and Asiana are doing, review every inherited vendor relationship and set of credentials before the systems are joined, not after.
Sources: Korean Air, Asiana Customer Information Leaked Through IT Service P... | Exclusive Korean Air also experiences customer personal data breach... | Data leak in Vietnam exposes 9 years of Korean airline passenger re... | 220 million traveler records exposed in Vietnam-linked APIS leak -... | ASEC Tracks Ransomware Dark Web Leaks Across 4 Countries — vpn.social | Protecting Only the Core Entry Points Is Not Enough: "The Gap Betwe... | AI-Assisted Hackers Access Millions of Airline Records | Notice of Merger-Related Personal Information Transfer│ASIANA AIRLINES