Korean Air breach exposes blind spot in airline cybersecurity

A data breach involving Korean Air and Asiana Airlines has highlighted the aviation sector’s reliance on third-party IT providers for core operations, particularly in booking and ticketing systems.

The incident, linked to Amadeus IT Group, involved unauthorized access on an account within Amadeus’ system and exposed customer reservation information, including some booking reference numbers, according to the carriers.

Both Korean Air and Asiana stated that their own internal systems did not show direct breaches and that payment data remained unaffected, as it is handled on separate transaction systems. They have activated security measures and are coordinating with Amadeus, which is also blocking unauthorized access and monitoring the dark web.

Industry officials note that the shared use of external platforms creates a systemic vulnerability: multiple carriers can be affected when a single provider experiences a security incident, given the widespread exchange of booking, ticketing, and passenger information across travel partners.

The carriers indicated they are seeking stronger safeguards from Amadeus and emphasized ongoing monitoring of partner security practices rather than relying solely on their own defenses, underscoring the broader challenge of defending against third-party risks in global aviation operations.

The breach is said to span a period from August 2023 to last month, though investigators have not yet determined the exact timing, and the full scope and number of affected customers remain under investigation.