Korean Air and Asiana Airlines confirmed data breaches involving unauthorized access to passenger reservation information via the external Amadeus IT Group ticketing system. Investigations indicate the unauthorized access persisted via valid account credentials between August 2023 and September 2026 without compromising internal airline databases. While payment details remained untouched, the exposed booking reference records highlight deep third-party risks inherent in centralized aviation infrastructure shared globally. Both carriers and Amadeus moved quickly to block unauthorized entry, review vendor contractor security, and monitor dark web channels for data resale. The incident is expected to draw rigorous regulatory examination under strict data protection laws, underscoring the urgent need for enhanced vendor access controls.

Full report : Korean Air and Asiana Airlines Suffer Customer Data Breaches Through Third-Party Amadeus Reservation Systems.