Korean Air and Asiana Airlines reports data breach through Amadeus reservation and booking systems

Korean Air and Asiana Airlines have reported a personal data security breach involving the operator of its reservation and booking system Amadeus IT Group, S.A. (Amadeus).

The peresonal data breach was identified within the system of Amadeus, and both Hanjin Group carriers were notified of the breach by the global airline reservation and IT system operator on 2244H Korea Standard Time (KST) October 20, 2026. An investigation has indicated that the incident involved unauthorized access using credentials assigned to Amadeus's system accounts, estimated to have occurred between August 2023 and September 2026. Some passengers’ Booking Reference Numbers (PNR) are included among the affected data set. Verification regarding other potential breach items is currently underway through Amadeus, and updates will be provided promptly as details are confirmed.

As the airline sent notifications by email to affected customers identified so far, Korean Air and Asiana have implemented initial security measures and confirmed no evidence of infringement of their internal databases. A formal report with the relevant South Korean government authorities was also filed.

Affected customers who have received the email from the airlines have been advised on their options to seek remedies, such as applying for dispute mediation or claiming compensation for damages, under applicable data protection laws, including Articles 39, 39-2, and 43 of the Korean Personal Information Protection Act (Personal Information Dispute Mediation Committee: +82-1833-6972).

“Amadeus has reported that remediation measures, including blocking unauthorized access and initiating dark web monitoring, are underway. Furthermore, Korean Air is working closely with Amadeus to enforce strengthened security measures and comprehensive prevention strategies beyond these initial actions.”

No secondary damage has been reported to date. The airline further advises customers to refrain from clicking unfamiliar links, downloading unknown attachments, or responding to requests for personal information.

“Although this incident occurred within Amadeus's domain, Korean Air takes this matter seriously and is committed to preventing recurrence. We regret any concern this situation may cause.”