Korean Air Breach: Booking References and Who Gets Notified
Korean Air has confirmed that some customers' booking references were exposed in a service provider's system. It is investigating whether other data was exposed, and not receiving an email alone does not establish that a customer's data was not exposed.
- The data confirmed as exposed in Korean Air's notice consists of some customers' booking references. Other potentially exposed data is under investigation.
- Korean Air became aware of the incident at 10:44 p.m. on October 20, 2026.
- The estimated breach period is between August 2023 and September 2026, and the exact timing is still being investigated.
- Korean Air has notified those confirmed to be affected by email and plans to notify affected individuals of any additional findings.
- The items listed under data collection and outsourced processing in the privacy policy must be distinguished from the data actually exposed in this incident.
The information confirmed to have been exposed in the Korean Air personal data breach is booking reference numbers for some customers. Additional types of exposed information are under investigation. Customers confirmed to be affected have been notified by email. Not receiving an email does not, by itself, confirm that a customer's information was not exposed.
The timeline is based on Korean Air's incident notice and the Newsis report dated October 23, 2026.
What has been confirmed about the exposure of booking reference numbers?
Korean Air stated that booking reference numbers for some customers were among the exposed information. This was not an announcement that all customers' information had been exposed. Information other than booking reference numbers is being checked through Amadeus IT Group.
A booking reference number is an identifier used to distinguish bookings. Exposure of a booking reference number does not mean the same thing as exposure of an entire booking record. Further confirmation is needed to determine whether names or passport numbers were also exposed.
| Category | Confirmed information | Limits on interpretation |
|---|---|---|
| Booking reference numbers | Exposure confirmed for some customers | Cannot be applied to all customers |
| Additional personal data types | Under investigation | Exposure of each type cannot be determined conclusively |
| Total number of people affected | No specific number given in the official notice | No basis for estimating the number of affected people |
| Payment information | Newsis reported that it was not included in the breach | Must be distinguished from the investigation into additional data types described in the official notice |
The Newsis report stated that Asiana Airlines had also confirmed an incident involving the same provider. However, this does not mean the same people were affected at both airlines. The scope of exposure for each individual must be determined from the respective airline's notification.
How do the incident date and notification date differ?
The estimated period during which the incident occurred differs from the date Korean Air learned of it. The reporting date is another separate point in time. Korean Air's notice itself does not display a publication date.
| Type of date | Date or period | Meaning |
|---|---|---|
| Estimated breach period | Between August 2023 and September 2026 | Period during which the incident is estimated to have occurred |
| When Korean Air became aware | October 20, 2026, at 10:44 p.m. | When it received official notification from Amadeus |
| Newsis reporting date | October 23, 2026 | Date the incident was reported |
| Official notice publication date | Not displayed | Cannot be replaced with the reporting date or the date Korean Air became aware |
The estimated breach period does not mean that exposure continued throughout that period. Nor does it mean that every customer who flew during that time was affected. The exact timing of the incident is under investigation.
The difference between a breach at a service provider and a breach of Korean Air's own systems
The access method described in the notice involved login credentials for a system account at a service provider. A service provider is a company that handles work on behalf of another company. Amadeus handles work related to airline reservations and ticketing.
The Korean Air incident notice describes the access method as follows.
Unauthorized access using login credentials assigned to an Amadeus system account
The quoted document is Korean Air's “Notice of Personal Data (Booking Reference Number) Exposure Affecting Some Customers.”
Korean Air stated that there was no indication of a breach of its own systems or databases. This is consistent with the explanation that customer information was exposed at an external service provider. It also cannot be read as an announcement that customers' Korean Air account passwords were stolen.
Korean Air stated that it took security measures, including reporting the incident, after becoming aware of it. It said Amadeus was blocking unauthorized access and monitoring the dark web. Korean Air also requested additional protective measures and steps to prevent a recurrence.
What receiving or not receiving an email means in each situation
Korean Air has notified customers whose personal data has been confirmed so far to have been exposed. Whether an email was received cannot, by itself, establish the full findings of the investigation. The airline's policy is to notify affected customers again if additional data types are confirmed.
| Situation | What can be determined | What else to check |
|---|---|---|
| You received a genuine notification email from Korean Air | You are among those identified so far for notification | The types of your information listed as exposed in the email |
| You did not receive a notification email | Only that you have not received an email | Any additional notifications and changes to the official notice |
| You received a notice from an unclear source | Whether it is a genuine notification has not been established | The official website and the contact channels listed in the notice |
| You took a flight during the estimated breach period | Only when you used the service | Whether you are among those affected |
The official notice does not provide a separate service for individuals to check whether their information was exposed. The standard booking lookup feature also cannot be considered a service for checking whether someone was affected by the breach. Information about your own case should be checked through individual notifications and official contact channels.
Comparing the privacy policy and the incident notice
Not every type of information listed in the privacy policy was exposed. The policy explains what information is normally processed and for what purposes. The incident notice is a document explaining the scope of the breach confirmed in a specific incident.
The Korean Air privacy policy lists booking reference numbers among the information collected. It also identifies Amadeus as a service provider for reservations and ticketing. These statements alone cannot expand the scope of exposure in this incident.
| Document | What it establishes | What it cannot establish |
|---|---|---|
| Privacy policy | Information normally collected, processing purposes, and service provider relationships | The types of information actually exposed in this incident |
| Incident notice | Confirmed circumstances of the incident and the status of the investigation | Final findings for data types still under investigation |
| Individual notification | The exposed information described in the notice sent to you | The scope of harm to other customers |
Treating the full list in the privacy policy as the list of information exposed in the incident is a misinterpretation. Conversely, it is also wrong to conclude that every type of information not mentioned in the incident notice is safe. Data types under investigation must remain separate from those confirmed.
Common mistakes when reading official guidance
Avoid combining statements with different scopes into a single conclusion. In particular, findings concerning some customers must not be applied to all customers. The phrase “under investigation” also does not mean that exposure has been confirmed or ruled out.
| Common interpretation | Facts that must be distinguished |
|---|---|
| Booking reference numbers were exposed, so all booking information was exposed | Confirmation about booking reference numbers is separate from the investigation into additional data types |
| There was no breach of the airline's own databases, so no customer information was exposed | Exposure at an external service provider can occur separately |
| I did not receive an email, so I am not affected | Notifications cover those confirmed so far to be affected |
| The incident occurred on the reporting date | The reporting date, the date the airline became aware, and the estimated breach period are different |
| No secondary harm has been confirmed, so there is no risk | The absence of confirmed harm is separate from the possibility of future harm |
Suspicious communications and contact channels for reporting harm
Korean Air's personal data breach notice advises caution with communications from unclear sources. The notice states that no cases of secondary harm had been confirmed at that time. This is not a guarantee that no harm will occur in the future.
- Do not click links from unclear sources.
- Do not download attachments from unknown sources.
- Do not comply with requests for personal information in communications from unclear sources.
The contact point for reporting harm listed in the notice is Korean Air's Passenger Business Division. The phone number is 1588-2001. The email address is [email protected].
Frequently asked questions
Has it been confirmed that only booking reference numbers were exposed?
It has been confirmed that booking reference numbers were included. There has been no final determination that only booking reference numbers were exposed. Other data types are under investigation.
Are all customers who used the airline from 2023 to 2026 affected?
The period of use alone cannot determine who is affected. The period given in the notice is the estimated time frame for the incident. There has been no announcement that every passenger's information was exposed.
Were Korean Air member account passwords also exposed?
The notice did not state that exposure of customers' member account passwords had been confirmed. The credentials mentioned in the account of the incident refer to an Amadeus system account. The two accounts must not be treated as the same.
What should I check if the news report and the official notice differ?
First, distinguish which data types each document has confirmed. The report's statement about payment information needs to be distinguished from the notice's investigation into additional data types. Check individual notifications and follow-up notices for information that applies to you.
FAQ
What information has been confirmed as exposed in this incident?
Korean Air's notice confirms that some customers' booking reference numbers were exposed. Checks are underway with Amadeus to identify any additional information that was exposed.
Does not receiving a notification email mean I was not affected by the breach?
Not receiving an email alone does not confirm that your information was not exposed. Korean Air has notified those identified as affected so far and plans to notify anyone else identified through further checks.
Did the data breach occur on October 23, 2026?
October 23, 2026 is the date of the Newsis report. Korean Air became aware of the incident at 10:44 p.m. on October 20, 2026. The incident is estimated to have occurred between August 2023 and September 2026.
Were Korean Air's own databases also breached?
Korean Air stated that there is no indication that its own systems or databases were breached. The notice describes an incident that occurred in the systems of Amadeus, an external contractor.
Was payment information also exposed?
On October 23, 2026, Newsis reported that payment information was not included in the breach. Korean Air's notice explains that information other than booking reference numbers is still being checked. You must distinguish between what the two documents confirm.
Is there a separate website for checking whether you were affected by the breach?
The Korean Air incident notice reviewed does not list a separate service for checking whether someone was affected. The standard booking lookup feature must not be presented as a service for checking whether someone was affected by the breach.
Was all the information listed in the privacy policy exposed?
The privacy policy is a document that explains the scope of routine personal information processing. Its list cannot be interpreted as the information actually exposed in this incident.
Who should I contact if I suffer harm as a result of this incident?
The notice lists Korean Air's Passenger Business Division as the point of contact. The phone number is 1588-2001. The email address is [email protected].
Sources
Images
