Korean Air (003490) said personal customer data had been exposed at the operator of its reservation and ticketing system.
Korean Air was notified on the night of the 20th by Amadeus IT Group, a global aviation IT systems operator, that there were signs of a personal data leak through its system, according to aviation industry sources on the 23rd.
Amadeus is a global IT company that provides software used by airlines, hotels and travel agencies.
Korean Air said it believes information including booking numbers was leaked through the Amadeus system. The scale of the breach and the categories of data involved have not yet been confirmed.
Asiana Airlines (020560) also confirmed a personal data leak from the same provider.
The incident resulted from unauthorized access using login credentials assigned to an Amadeus system account. The breach is believed to have occurred between August 2023 and September this year, with the exact timing under investigation.
Korean Air and Asiana Airlines said the exposed data included booking numbers but did not include payment information.
The two carriers implemented necessary safety measures immediately after being notified of the incident and demanded that Amadeus strengthen its personal data protection and draw up measures to prevent a recurrence.
Korean Air notified customers of the data leak on the same day and urged them not to click on links from unidentified sources or download attachments, to prevent secondary damage.
"We recognize the gravity of this situation and plan to devote all our efforts to preventing further damage and any recurrence," a Korean Air official said. "We will conduct thorough inspections of our contractors and further strengthen measures to protect customer information."