Executive Summary
Korean Air and Asiana Airlines experienced a data breach involving unauthorized access to customer reservation information through the external Amadeus IT Group reservation and ticketing system. The breach, which occurred between August 2023 and September 2026, was executed using valid login credentials for an Amadeus system account. Both airlines confirmed that booking reference numbers were exposed, while payment data was not affected. There is no evidence that the airlines’ internal systems or databases were compromised. Immediate mitigation steps were taken by both the airlines and Amadeus, including blocking unauthorized access and monitoring the dark web for further risks. The incident underscores the critical third-party risks in the aviation sector and may prompt regulatory scrutiny under South Korea’s revised Personal Information Protection Act. The full scope of the breach remains under investigation.
Technical Information
The breach targeting Korean Air and Asiana Airlines was executed through unauthorized access to an Amadeus IT Group system account using valid login credentials. This attack vector aligns with the MITRE ATT&CK technique T1078: Valid Accounts, where attackers leverage stolen or compromised credentials to gain unauthorized access to systems. All available evidence from primary sources confirms that no malware, phishing, or exploitation of software vulnerabilities was involved in this incident. The breach window is estimated from August 2023 to September 2026, based on notifications and public disclosures.
No technical indicators such as malware hashes, malicious domains, or command-and-control infrastructure have been reported or observed in any of the primary sources. The breach was limited to credential abuse, with no evidence of lateral movement into the airlines’ internal networks or databases. The attack did not involve the exploitation of software vulnerabilities (no CVEs or exploit chains referenced).
Historically, the airline sector has been a frequent target for credential abuse, particularly against third-party IT providers like Amadeus. Previous research has documented large volumes of credentials for Amadeus systems exposed on cybercrime forums, highlighting the persistent risk of credential-based attacks in this sector. However, there is no direct attribution to a specific threat actor or group in this case, and no unique tactics, techniques, or procedures (TTPs) have been identified beyond credential abuse.
The breach highlights the aviation sector’s reliance on external IT providers, creating shared points of vulnerability. Amadeus systems are used by over 130 airlines globally, raising concerns about the potential for broader exposure. Regulatory scrutiny is increasing, with South Korea’s Personal Information Protection Commission considering an investigation and new laws imposing fines up to 10% of revenue for large-scale or repeated breaches.
Immediate mitigation steps included Amadeus blocking unauthorized access, monitoring the dark web for signs of data resale or further compromise, and both airlines activating internal security measures and conducting contractor inspections. The airlines have also demanded enhanced protective measures and preventive strategies from Amadeus.
Affected Versions & Timeline
The breach affected the Amadeus IT Group reservation and ticketing system accounts used by Korean Air and Asiana Airlines. The estimated incident window for unauthorized access is from August 2023 to September 2026. Amadeus notified the airlines of the breach on October 20, 2026. Public confirmation and customer notifications were issued by the airlines on October 23, 2026. Sector analysis and further details were published on October 25, 2026.
Threat Activity
The primary threat activity involved the use of compromised login credentials to access the Amadeus reservation system. There is no evidence of malware deployment, phishing, or exploitation of software vulnerabilities. The attack did not extend to the airlines’ internal networks or databases, and payment data was not affected. The breach is consistent with credential abuse patterns observed in previous attacks on third-party IT providers in the aviation sector. No specific threat actor attribution is possible based on current evidence, but the activity aligns with financially motivated cybercriminals or initial access brokers.
Mitigation & Workarounds
Mitigation steps taken in response to the breach include Amadeus blocking unauthorized access to affected accounts and initiating dark web monitoring for signs of data exposure. Korean Air and Asiana Airlines activated internal security measures, began contractor inspections, and demanded enhanced safeguards from Amadeus. Customers were notified of the breach, and regulatory authorities may investigate under new data protection laws. Recommended actions for organizations using third-party IT providers include enforcing strong credential management policies, enabling multi-factor authentication, conducting regular audits of third-party access, and monitoring for unusual account activity. These measures are considered critical due to the high risk associated with credential abuse and third-party dependencies.
Indicators of Compromise
At the time of writing, no public indicators of compromise (IOCs) were available in any of the primary sources. Organizations are advised to validate any future indicators before enforcement.
References
The Korea Times, Oct 25, 2026: https://www.koreatimes.co.kr/business/companies/20261025/korean-air-breach-exposes-blind-spot-in-airline-cybersecurity
Aju Press, Oct 23, 2026: https://m.ajupress.com/amp/20261023214470998
BigGo Finance, Oct 23, 2026: https://finance.biggo.com/news/a745bc08-0e93-472c-bff3-5b15529bfbb6
Hudson Rock, 2023: https://www.hudsonrock.com/search/domain/amadeus.com
UpGuard Security Report: https://www.upguard.com/security-report/amadeus-com
Cybersecurity Dive: https://www.cybersecuritydive.com/news/threat-actors-abuse-valid-accounts-crowdstrike/690170/
MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/
About Rescana
Rescana provides a Third-Party Risk Management (TPRM) platform designed to help organizations identify, assess, and monitor cybersecurity risks associated with external vendors and service providers. Our platform enables continuous risk assessment, supports regulatory compliance, and delivers actionable insights for managing third-party dependencies in complex supply chains.
We are happy to answer questions at info@rescana.com.
