PRIVACY DETECTIVE · KOREAN AIR AND ASIANA AIRLINES (PROCESSOR: AMADEUS)
Korean Air and Asiana booking data breach via Amadeus (2026)
The airlines said someone used login credentials for an account on the systems of Amadeus IT Group, which handles their reservations and ticketing, and that customer booking references leaked (23 Oct 2026). They say payment data was not included; scale and other data items are under investigation.
Checked 2026-10-24
- Affected
- Not published
- Data taken
- Other
- Confirmed money loss
- None confirmed
- Entry vector
- Third-party breach
- Attack → detection
- ~1,176 days
- Fines
- None / not published
- Proceeds recovered
- Not published
05 STEPS
Breach → taken → resold → money → who paid
- 1. HOW IT HAPPENED
How it happened — Unauthorised access through an account on the processor’s booking system (est. Aug 2023–Sep 2026)
- 2. WHO GOT THE DATA
Who got the data — Not established by official sources
- 3. HOW IT WAS RESOLD
Was it resold — Not established by official sources
- 4. HOW IT BECAME MONEY
How it became money — Not established by official sources
- 5. WHO PAID THE LOSS
Who paid the loss — Not settled. Korean Air says no secondary harm has been confirmed
TIMELINE
Time to detect, report and notify
- Attack start → detection
- 2023-08 → 2026-10-20 · ~1,176 days
- Detection → report
- Not published
- Detection → customer notice
- 3 days
Airline statements: estimated Aug 2023–Sep 2026 (under investigation); Amadeus notice 20 Oct 22:44; customer emails 23 Oct
DATA
What was taken, and what it enables
- Identity data
- Other
What this combination can be used for
- Identity data only → Spam, impersonation calls, targeted phishing (e.g. luring you into a reset)
Airline statements: unauthorised access with login credentials for an Amadeus system account; how the credentials were obtained is not disclosed. "Other" is the booking reference; names and contact details are unconfirmed.
CRIME-AS-A-SERVICE
Roles confirmed in this case
No perpetrator or role is established by official sources.
○ Victim data stolen → ○ Brokered and resold → ○ Buyer takes over accounts → ○ Fraud or unauthorised payment → ○ Mule account → ○ Laundering → ○ Cash-out
● step confirmed in this case · ○ not established (which does not mean it did not happen)
GEOGRAPHY
Location facts, kept apart
| Field | Value | Basis |
|---|
| Victim country | Customers of Korean airlines | Media report News (citing officials) 2026-10 |
| Infrastructure location | Amadeus systems (privacy policies list Germany as the transfer destination) This is the transfer country in the privacy policies, not the confirmed location of the breached server | Unknown Company 2026-10 · Company 2026-10 |
Login-IP countries can differ from an attacker’s nationality or base because of VPNs, proxies and hijacked devices. Nationality appears only for individuals named by investigators and is never generalised to a country.
LOSS & PROCEEDS
Victim loss and criminal proceeds
- Victim money loss
- No amount established
RESPONSE & ENFORCEMENT
Company response and enforcement
- Company statement · 2026-10-23
- Korean Air relayed that Amadeus blocked the access and runs dark-web monitoring; both airlines say their own databases show no direct intrusion News (citing officials) 2026-10
- Security spend before vs costs after
- Not public — security budgets and legal costs are not estimated
CLAIM VS FINDING
Where statements and findings differ
COMPANY CLAIM — The incident occurred within Amadeus’s area of management (Korean Air (23 Oct 2026)) News (citing officials) 2026-10
RESPONSE — Both airlines’ privacy policies name Amadeus as their processor for reservations and ticketing, and Korean law makes the controller supervise its processor (art. 26). Liability has not been decided (AMS — privacy policies and statute) Company 2026-10 · Company 2026-10
DETECTIVE RADAR
Korean Air and Asiana booking data breach via Amadeus (2026) from other angles
△Origin DetectiveApplies · not analysed yet
△Distribution DetectiveApplies · not analysed yet
△Tax DetectiveApplies · not analysed yet
△Wage DetectiveApplies · not analysed yet
✓Privacy DetectiveThis page
△Regulation DetectiveApplies · not analysed yet
✓ analysed · △ applies, not analysed yet · not applicable: Cost Detective, Inflation Detective, Discount Detective, Value Detective, Hype Detective, Hogu Index, Ingredient Detective (food & drinks) · All axes on one page