{"content_id":"zchfs48bng","slug":"korean-air-data-breach-booking-number-notice","locale":"en","schema_type":"Article","category":"news","category_name":"News","title":"Korean Air Breach: Booking References and Who Gets Notified","summary":"Korean Air has confirmed that some customers' booking references were exposed in a service provider's system. It is investigating whether other data was exposed, and not receiving an email alone does not establish that a customer's data was not exposed.","sponsorship_disclosure":null,"affiliate_disclosure":null,"commerce_disclosure":null,"author":{"name":"Injoys Editorial Team","url":"https://injoys.com/ko/about"},"key_points":["The data confirmed as exposed in Korean Air's notice consists of some customers' booking references. Other potentially exposed data is under investigation.","Korean Air became aware of the incident at 10:44 p.m. on October 20, 2026.","The estimated breach period is between August 2023 and September 2026, and the exact timing is still being investigated.","Korean Air has notified those confirmed to be affected by email and plans to notify affected individuals of any additional findings.","The items listed under data collection and outsourced processing in the privacy policy must be distinguished from the data actually exposed in this incident."],"content_markdown":"The information confirmed to have been exposed in the Korean Air personal data breach is **booking reference numbers for some customers**. Additional types of exposed information are under investigation. Customers confirmed to be affected have been notified by email. Not receiving an email does not, by itself, confirm that a customer's information was not exposed.\n\nThe timeline is based on Korean Air's incident notice and the Newsis report dated October 23, 2026.\n\n## What has been confirmed about the exposure of booking reference numbers?\n\nKorean Air stated that booking reference numbers for some customers were among the exposed information. This was not an announcement that all customers' information had been exposed. Information other than booking reference numbers is being checked through Amadeus IT Group.\n\nA booking reference number is an identifier used to distinguish bookings. Exposure of a booking reference number does not mean the same thing as exposure of an entire booking record. Further confirmation is needed to determine whether names or passport numbers were also exposed.\n\n| Category | Confirmed information | Limits on interpretation |\n| --- | --- | --- |\n| Booking reference numbers | Exposure confirmed for some customers | Cannot be applied to all customers |\n| Additional personal data types | Under investigation | Exposure of each type cannot be determined conclusively |\n| Total number of people affected | No specific number given in the official notice | No basis for estimating the number of affected people |\n| Payment information | Newsis reported that it was not included in the breach | Must be distinguished from the investigation into additional data types described in the official notice |\n\n[The Newsis report](https://mobile.newsis.com/view/NISX20261023_0003839294) stated that Asiana Airlines had also confirmed an incident involving the same provider. However, this does not mean the same people were affected at both airlines. The scope of exposure for each individual must be determined from the respective airline's notification.\n\n## How do the incident date and notification date differ?\n\nThe estimated period during which the incident occurred differs from the date Korean Air learned of it. The reporting date is another separate point in time. Korean Air's notice itself does not display a publication date.\n\n| Type of date | Date or period | Meaning |\n| --- | --- | --- |\n| Estimated breach period | Between August 2023 and September 2026 | Period during which the incident is estimated to have occurred |\n| When Korean Air became aware | October 20, 2026, at 10:44 p.m. | When it received official notification from Amadeus |\n| Newsis reporting date | October 23, 2026 | Date the incident was reported |\n| Official notice publication date | Not displayed | Cannot be replaced with the reporting date or the date Korean Air became aware |\n\nThe estimated breach period does not mean that exposure continued throughout that period. Nor does it mean that every customer who flew during that time was affected. The exact timing of the incident is under investigation.\n\n## The difference between a breach at a service provider and a breach of Korean Air's own systems\n\nThe access method described in the notice involved login credentials for a system account at a service provider. A service provider is a company that handles work on behalf of another company. Amadeus handles work related to airline reservations and ticketing.\n\n[The Korean Air incident notice](https://www.koreanair.com/contents/footer/customer-support/notice/2026/amadeus) describes the access method as follows.\n\n\u003e Unauthorized access using login credentials assigned to an Amadeus system account\n\nThe quoted document is Korean Air's “Notice of Personal Data (Booking Reference Number) Exposure Affecting Some Customers.”\n\nKorean Air stated that there was no indication of a breach of its own systems or databases. This is consistent with the explanation that customer information was exposed at an external service provider. It also cannot be read as an announcement that customers' Korean Air account passwords were stolen.\n\nKorean Air stated that it took security measures, including reporting the incident, after becoming aware of it. It said Amadeus was blocking unauthorized access and monitoring the dark web. Korean Air also requested additional protective measures and steps to prevent a recurrence.\n\n## What receiving or not receiving an email means in each situation\n\nKorean Air has notified customers whose personal data has been confirmed so far to have been exposed. Whether an email was received cannot, by itself, establish the full findings of the investigation. The airline's policy is to notify affected customers again if additional data types are confirmed.\n\n| Situation | What can be determined | What else to check |\n| --- | --- | --- |\n| You received a genuine notification email from Korean Air | You are among those identified so far for notification | The types of your information listed as exposed in the email |\n| You did not receive a notification email | Only that you have not received an email | Any additional notifications and changes to the official notice |\n| You received a notice from an unclear source | Whether it is a genuine notification has not been established | The official website and the contact channels listed in the notice |\n| You took a flight during the estimated breach period | Only when you used the service | Whether you are among those affected |\n\nThe official notice does not provide a separate service for individuals to check whether their information was exposed. The standard booking lookup feature also cannot be considered a service for checking whether someone was affected by the breach. Information about your own case should be checked through individual notifications and official contact channels.\n\n## Comparing the privacy policy and the incident notice\n\nNot every type of information listed in the privacy policy was exposed. The policy explains what information is normally processed and for what purposes. The incident notice is a document explaining the scope of the breach confirmed in a specific incident.\n\n[The Korean Air privacy policy](https://www.koreanair.com/contents/footer/terms-and-policies/privacy-policy) lists booking reference numbers among the information collected. It also identifies Amadeus as a service provider for reservations and ticketing. These statements alone cannot expand the scope of exposure in this incident.\n\n| Document | What it establishes | What it cannot establish |\n| --- | --- | --- |\n| Privacy policy | Information normally collected, processing purposes, and service provider relationships | The types of information actually exposed in this incident |\n| Incident notice | Confirmed circumstances of the incident and the status of the investigation | Final findings for data types still under investigation |\n| Individual notification | The exposed information described in the notice sent to you | The scope of harm to other customers |\n\nTreating the full list in the privacy policy as the list of information exposed in the incident is a misinterpretation. Conversely, it is also wrong to conclude that every type of information not mentioned in the incident notice is safe. Data types under investigation must remain separate from those confirmed.\n\n## Common mistakes when reading official guidance\n\nAvoid combining statements with different scopes into a single conclusion. In particular, findings concerning some customers must not be applied to all customers. The phrase “under investigation” also does not mean that exposure has been confirmed or ruled out.\n\n| Common interpretation | Facts that must be distinguished |\n| --- | --- |\n| Booking reference numbers were exposed, so all booking information was exposed | Confirmation about booking reference numbers is separate from the investigation into additional data types |\n| There was no breach of the airline's own databases, so no customer information was exposed | Exposure at an external service provider can occur separately |\n| I did not receive an email, so I am not affected | Notifications cover those confirmed so far to be affected |\n| The incident occurred on the reporting date | The reporting date, the date the airline became aware, and the estimated breach period are different |\n| No secondary harm has been confirmed, so there is no risk | The absence of confirmed harm is separate from the possibility of future harm |\n\n## Suspicious communications and contact channels for reporting harm\n\nKorean Air's personal data breach notice advises caution with communications from unclear sources. The notice states that no cases of secondary harm had been confirmed at that time. This is not a guarantee that no harm will occur in the future.\n\n- Do not click links from unclear sources.\n- Do not download attachments from unknown sources.\n- Do not comply with requests for personal information in communications from unclear sources.\n\nThe contact point for reporting harm listed in the notice is Korean Air's Passenger Business Division. The phone number is 1588-2001. The email address is privacy1a@koreanair.com.\n\n## Frequently asked questions\n\n### Has it been confirmed that only booking reference numbers were exposed?\n\nIt has been confirmed that booking reference numbers were included. There has been no final determination that only booking reference numbers were exposed. Other data types are under investigation.\n\n### Are all customers who used the airline from 2023 to 2026 affected?\n\nThe period of use alone cannot determine who is affected. The period given in the notice is the estimated time frame for the incident. There has been no announcement that every passenger's information was exposed.\n\n### Were Korean Air member account passwords also exposed?\n\nThe notice did not state that exposure of customers' member account passwords had been confirmed. The credentials mentioned in the account of the incident refer to an Amadeus system account. The two accounts must not be treated as the same.\n\n### What should I check if the news report and the official notice differ?\n\nFirst, distinguish which data types each document has confirmed. The report's statement about payment information needs to be distinguished from the notice's investigation into additional data types. Check individual notifications and follow-up notices for information that applies to you.","content_html":"\u003cp\u003eThe information confirmed to have been exposed in the Korean Air personal data breach is \u003cstrong\u003ebooking reference numbers for some customers\u003c/strong\u003e. Additional types of exposed information are under investigation. Customers confirmed to be affected have been notified by email. Not receiving an email does not, by itself, confirm that a customer's information was not exposed.\u003c/p\u003e\n\u003cp\u003eThe timeline is based on Korean Air's incident notice and the Newsis report dated October 23, 2026.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-has-been-confirmed-about-the-exposure-of-booking-reference-numbers\" class=\"anchor\" id=\"what-has-been-confirmed-about-the-exposure-of-booking-reference-numbers\"\u003e\u003c/a\u003eWhat has been confirmed about the exposure of booking reference numbers?\u003c/h2\u003e\n\u003cp\u003eKorean Air stated that booking reference numbers for some customers were among the exposed information. This was not an announcement that all customers' information had been exposed. Information other than booking reference numbers is being checked through Amadeus IT Group.\u003c/p\u003e\n\u003cp\u003eA booking reference number is an identifier used to distinguish bookings. Exposure of a booking reference number does not mean the same thing as exposure of an entire booking record. Further confirmation is needed to determine whether names or passport numbers were also exposed.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCategory\u003c/th\u003e\n\u003cth\u003eConfirmed information\u003c/th\u003e\n\u003cth\u003eLimits on interpretation\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eBooking reference numbers\u003c/td\u003e\n\u003ctd data-label=\"Confirmed information\"\u003eExposure confirmed for some customers\u003c/td\u003e\n\u003ctd data-label=\"Limits on interpretation\"\u003eCannot be applied to all customers\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eAdditional personal data types\u003c/td\u003e\n\u003ctd data-label=\"Confirmed information\"\u003eUnder investigation\u003c/td\u003e\n\u003ctd data-label=\"Limits on interpretation\"\u003eExposure of each type cannot be determined conclusively\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eTotal number of people affected\u003c/td\u003e\n\u003ctd data-label=\"Confirmed information\"\u003eNo specific number given in the official notice\u003c/td\u003e\n\u003ctd data-label=\"Limits on interpretation\"\u003eNo basis for estimating the number of affected people\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003ePayment information\u003c/td\u003e\n\u003ctd data-label=\"Confirmed information\"\u003eNewsis reported that it was not included in the breach\u003c/td\u003e\n\u003ctd data-label=\"Limits on interpretation\"\u003eMust be distinguished from the investigation into additional data types described in the official notice\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003e\u003ca href=\"https://mobile.newsis.com/view/NISX20261023_0003839294\"\u003eThe Newsis report\u003c/a\u003e stated that Asiana Airlines had also confirmed an incident involving the same provider. However, this does not mean the same people were affected at both airlines. The scope of exposure for each individual must be determined from the respective airline's notification.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#how-do-the-incident-date-and-notification-date-differ\" class=\"anchor\" id=\"how-do-the-incident-date-and-notification-date-differ\"\u003e\u003c/a\u003eHow do the incident date and notification date differ?\u003c/h2\u003e\n\u003cp\u003eThe estimated period during which the incident occurred differs from the date Korean Air learned of it. The reporting date is another separate point in time. Korean Air's notice itself does not display a publication date.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eType of date\u003c/th\u003e\n\u003cth\u003eDate or period\u003c/th\u003e\n\u003cth\u003eMeaning\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Type of date\"\u003eEstimated breach period\u003c/td\u003e\n\u003ctd data-label=\"Date or period\"\u003eBetween August 2023 and September 2026\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003ePeriod during which the incident is estimated to have occurred\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Type of date\"\u003eWhen Korean Air became aware\u003c/td\u003e\n\u003ctd data-label=\"Date or period\"\u003eOctober 20, 2026, at 10:44 p.m.\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eWhen it received official notification from Amadeus\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Type of date\"\u003eNewsis reporting date\u003c/td\u003e\n\u003ctd data-label=\"Date or period\"\u003eOctober 23, 2026\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eDate the incident was reported\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Type of date\"\u003eOfficial notice publication date\u003c/td\u003e\n\u003ctd data-label=\"Date or period\"\u003eNot displayed\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eCannot be replaced with the reporting date or the date Korean Air became aware\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eThe estimated breach period does not mean that exposure continued throughout that period. Nor does it mean that every customer who flew during that time was affected. The exact timing of the incident is under investigation.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#the-difference-between-a-breach-at-a-service-provider-and-a-breach-of-korean-airs-own-systems\" class=\"anchor\" id=\"the-difference-between-a-breach-at-a-service-provider-and-a-breach-of-korean-airs-own-systems\"\u003e\u003c/a\u003eThe difference between a breach at a service provider and a breach of Korean Air's own systems\u003c/h2\u003e\n\u003cp\u003eThe access method described in the notice involved login credentials for a system account at a service provider. A service provider is a company that handles work on behalf of another company. Amadeus handles work related to airline reservations and ticketing.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://www.koreanair.com/contents/footer/customer-support/notice/2026/amadeus\"\u003eThe Korean Air incident notice\u003c/a\u003e describes the access method as follows.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eUnauthorized access using login credentials assigned to an Amadeus system account\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThe quoted document is Korean Air's “Notice of Personal Data (Booking Reference Number) Exposure Affecting Some Customers.”\u003c/p\u003e\n\u003cp\u003eKorean Air stated that there was no indication of a breach of its own systems or databases. This is consistent with the explanation that customer information was exposed at an external service provider. It also cannot be read as an announcement that customers' Korean Air account passwords were stolen.\u003c/p\u003e\n\u003cp\u003eKorean Air stated that it took security measures, including reporting the incident, after becoming aware of it. It said Amadeus was blocking unauthorized access and monitoring the dark web. Korean Air also requested additional protective measures and steps to prevent a recurrence.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-receiving-or-not-receiving-an-email-means-in-each-situation\" class=\"anchor\" id=\"what-receiving-or-not-receiving-an-email-means-in-each-situation\"\u003e\u003c/a\u003eWhat receiving or not receiving an email means in each situation\u003c/h2\u003e\n\u003cp\u003eKorean Air has notified customers whose personal data has been confirmed so far to have been exposed. Whether an email was received cannot, by itself, establish the full findings of the investigation. The airline's policy is to notify affected customers again if additional data types are confirmed.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSituation\u003c/th\u003e\n\u003cth\u003eWhat can be determined\u003c/th\u003e\n\u003cth\u003eWhat else to check\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Situation\"\u003eYou received a genuine notification email from Korean Air\u003c/td\u003e\n\u003ctd data-label=\"What can be determined\"\u003eYou are among those identified so far for notification\u003c/td\u003e\n\u003ctd data-label=\"What else to check\"\u003eThe types of your information listed as exposed in the email\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Situation\"\u003eYou did not receive a notification email\u003c/td\u003e\n\u003ctd data-label=\"What can be determined\"\u003eOnly that you have not received an email\u003c/td\u003e\n\u003ctd data-label=\"What else to check\"\u003eAny additional notifications and changes to the official notice\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Situation\"\u003eYou received a notice from an unclear source\u003c/td\u003e\n\u003ctd data-label=\"What can be determined\"\u003eWhether it is a genuine notification has not been established\u003c/td\u003e\n\u003ctd data-label=\"What else to check\"\u003eThe official website and the contact channels listed in the notice\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Situation\"\u003eYou took a flight during the estimated breach period\u003c/td\u003e\n\u003ctd data-label=\"What can be determined\"\u003eOnly when you used the service\u003c/td\u003e\n\u003ctd data-label=\"What else to check\"\u003eWhether you are among those affected\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eThe official notice does not provide a separate service for individuals to check whether their information was exposed. The standard booking lookup feature also cannot be considered a service for checking whether someone was affected by the breach. Information about your own case should be checked through individual notifications and official contact channels.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#comparing-the-privacy-policy-and-the-incident-notice\" class=\"anchor\" id=\"comparing-the-privacy-policy-and-the-incident-notice\"\u003e\u003c/a\u003eComparing the privacy policy and the incident notice\u003c/h2\u003e\n\u003cp\u003eNot every type of information listed in the privacy policy was exposed. The policy explains what information is normally processed and for what purposes. The incident notice is a document explaining the scope of the breach confirmed in a specific incident.\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://www.koreanair.com/contents/footer/terms-and-policies/privacy-policy\"\u003eThe Korean Air privacy policy\u003c/a\u003e lists booking reference numbers among the information collected. It also identifies Amadeus as a service provider for reservations and ticketing. These statements alone cannot expand the scope of exposure in this incident.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eDocument\u003c/th\u003e\n\u003cth\u003eWhat it establishes\u003c/th\u003e\n\u003cth\u003eWhat it cannot establish\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Document\"\u003ePrivacy policy\u003c/td\u003e\n\u003ctd data-label=\"What it establishes\"\u003eInformation normally collected, processing purposes, and service provider relationships\u003c/td\u003e\n\u003ctd data-label=\"What it cannot establish\"\u003eThe types of information actually exposed in this incident\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Document\"\u003eIncident notice\u003c/td\u003e\n\u003ctd data-label=\"What it establishes\"\u003eConfirmed circumstances of the incident and the status of the investigation\u003c/td\u003e\n\u003ctd data-label=\"What it cannot establish\"\u003eFinal findings for data types still under investigation\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Document\"\u003eIndividual notification\u003c/td\u003e\n\u003ctd data-label=\"What it establishes\"\u003eThe exposed information described in the notice sent to you\u003c/td\u003e\n\u003ctd data-label=\"What it cannot establish\"\u003eThe scope of harm to other customers\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eTreating the full list in the privacy policy as the list of information exposed in the incident is a misinterpretation. Conversely, it is also wrong to conclude that every type of information not mentioned in the incident notice is safe. Data types under investigation must remain separate from those confirmed.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#common-mistakes-when-reading-official-guidance\" class=\"anchor\" id=\"common-mistakes-when-reading-official-guidance\"\u003e\u003c/a\u003eCommon mistakes when reading official guidance\u003c/h2\u003e\n\u003cp\u003eAvoid combining statements with different scopes into a single conclusion. In particular, findings concerning some customers must not be applied to all customers. The phrase “under investigation” also does not mean that exposure has been confirmed or ruled out.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCommon interpretation\u003c/th\u003e\n\u003cth\u003eFacts that must be distinguished\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Common interpretation\"\u003eBooking reference numbers were exposed, so all booking information was exposed\u003c/td\u003e\n\u003ctd data-label=\"Facts that must be distinguished\"\u003eConfirmation about booking reference numbers is separate from the investigation into additional data types\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Common interpretation\"\u003eThere was no breach of the airline's own databases, so no customer information was exposed\u003c/td\u003e\n\u003ctd data-label=\"Facts that must be distinguished\"\u003eExposure at an external service provider can occur separately\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Common interpretation\"\u003eI did not receive an email, so I am not affected\u003c/td\u003e\n\u003ctd data-label=\"Facts that must be distinguished\"\u003eNotifications cover those confirmed so far to be affected\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Common interpretation\"\u003eThe incident occurred on the reporting date\u003c/td\u003e\n\u003ctd data-label=\"Facts that must be distinguished\"\u003eThe reporting date, the date the airline became aware, and the estimated breach period are different\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Common interpretation\"\u003eNo secondary harm has been confirmed, so there is no risk\u003c/td\u003e\n\u003ctd data-label=\"Facts that must be distinguished\"\u003eThe absence of confirmed harm is separate from the possibility of future harm\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003ch2\u003e\n\u003ca href=\"#suspicious-communications-and-contact-channels-for-reporting-harm\" class=\"anchor\" id=\"suspicious-communications-and-contact-channels-for-reporting-harm\"\u003e\u003c/a\u003eSuspicious communications and contact channels for reporting harm\u003c/h2\u003e\n\u003cp\u003eKorean Air's personal data breach notice advises caution with communications from unclear sources. The notice states that no cases of secondary harm had been confirmed at that time. This is not a guarantee that no harm will occur in the future.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDo not click links from unclear sources.\u003c/li\u003e\n\u003cli\u003eDo not download attachments from unknown sources.\u003c/li\u003e\n\u003cli\u003eDo not comply with requests for personal information in communications from unclear sources.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe contact point for reporting harm listed in the notice is Korean Air's Passenger Business Division. The phone number is 1588-2001. The email address is \u003ca href=\"mailto:privacy1a@koreanair.com\"\u003eprivacy1a@koreanair.com\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#frequently-asked-questions\" class=\"anchor\" id=\"frequently-asked-questions\"\u003e\u003c/a\u003eFrequently asked questions\u003c/h2\u003e\n\u003ch3\u003e\n\u003ca href=\"#has-it-been-confirmed-that-only-booking-reference-numbers-were-exposed\" class=\"anchor\" id=\"has-it-been-confirmed-that-only-booking-reference-numbers-were-exposed\"\u003e\u003c/a\u003eHas it been confirmed that only booking reference numbers were exposed?\u003c/h3\u003e\n\u003cp\u003eIt has been confirmed that booking reference numbers were included. There has been no final determination that only booking reference numbers were exposed. Other data types are under investigation.\u003c/p\u003e\n\u003ch3\u003e\n\u003ca href=\"#are-all-customers-who-used-the-airline-from-2023-to-2026-affected\" class=\"anchor\" id=\"are-all-customers-who-used-the-airline-from-2023-to-2026-affected\"\u003e\u003c/a\u003eAre all customers who used the airline from 2023 to 2026 affected?\u003c/h3\u003e\n\u003cp\u003eThe period of use alone cannot determine who is affected. The period given in the notice is the estimated time frame for the incident. There has been no announcement that every passenger's information was exposed.\u003c/p\u003e\n\u003ch3\u003e\n\u003ca href=\"#were-korean-air-member-account-passwords-also-exposed\" class=\"anchor\" id=\"were-korean-air-member-account-passwords-also-exposed\"\u003e\u003c/a\u003eWere Korean Air member account passwords also exposed?\u003c/h3\u003e\n\u003cp\u003eThe notice did not state that exposure of customers' member account passwords had been confirmed. The credentials mentioned in the account of the incident refer to an Amadeus system account. The two accounts must not be treated as the same.\u003c/p\u003e\n\u003ch3\u003e\n\u003ca href=\"#what-should-i-check-if-the-news-report-and-the-official-notice-differ\" class=\"anchor\" id=\"what-should-i-check-if-the-news-report-and-the-official-notice-differ\"\u003e\u003c/a\u003eWhat should I check if the news report and the official notice differ?\u003c/h3\u003e\n\u003cp\u003eFirst, distinguish which data types each document has confirmed. The report's statement about payment information needs to be distinguished from the notice's investigation into additional data types. Check individual notifications and follow-up notices for information that applies to you.\u003c/p\u003e\n","tags":["Personal data","Personal data protection"],"faqs":[{"question":"What information has been confirmed as exposed in this incident?","answer":"Korean Air's notice confirms that some customers' booking reference numbers were exposed. Checks are underway with Amadeus to identify any additional information that was exposed."},{"question":"Does not receiving a notification email mean I was not affected by the breach?","answer":"Not receiving an email alone does not confirm that your information was not exposed. Korean Air has notified those identified as affected so far and plans to notify anyone else identified through further checks."},{"question":"Did the data breach occur on October 23, 2026?","answer":"October 23, 2026 is the date of the Newsis report. Korean Air became aware of the incident at 10:44 p.m. on October 20, 2026. The incident is estimated to have occurred between August 2023 and September 2026."},{"question":"Were Korean Air's own databases also breached?","answer":"Korean Air stated that there is no indication that its own systems or databases were breached. The notice describes an incident that occurred in the systems of Amadeus, an external contractor."},{"question":"Was payment information also exposed?","answer":"On October 23, 2026, Newsis reported that payment information was not included in the breach. Korean Air's notice explains that information other than booking reference numbers is still being checked. You must distinguish between what the two documents confirm."},{"question":"Is there a separate website for checking whether you were affected by the breach?","answer":"The Korean Air incident notice reviewed does not list a separate service for checking whether someone was affected. The standard booking lookup feature must not be presented as a service for checking whether someone was affected by the breach."},{"question":"Was all the information listed in the privacy policy exposed?","answer":"The privacy policy is a document that explains the scope of routine personal information processing. Its list cannot be interpreted as the information actually exposed in this incident."},{"question":"Who should I contact if I suffer harm as a result of this incident?","answer":"The notice lists Korean Air's Passenger Business Division as the point of contact. The phone number is 1588-2001. The email address is privacy1a@koreanair.com."}],"sources":[{"url":"https://www.koreanair.com/contents/footer/customer-support/notice/2026/amadeus","title":"Korean Air - Notice of a leak of some customers' personal information (reservation numbers)","type":"source"},{"url":"https://mobile.newsis.com/view/NISX20261023_0003839294","title":"Newsis - Personal information leaked at Korean Air and Asiana… IT partner hacked","type":"source"},{"url":"https://www.koreanair.com/contents/footer/terms-and-policies/privacy-policy","title":"Korean Air - Privacy Policy","type":"source"}],"images":[{"id":2109,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6MzI0MDcsInB1ciI6ImJsb2JfaWQifX0=--c6509be7518021d15540b4e29defb2b9f233991e/ai-390f053c.webp","is_representative":true,"generation_method":"ai_photo","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"공항 대기석에서 여행 가방을 옆에 두고 스마트폰을 확인하는 남성, 창밖으로 보이는 항공기","caption":"대한항공은 예약번호 유출이 확인된 대상자에게 이메일로 안내했다.","description":null},"en":{"alt":"A man checks his phone beside a suitcase in an airport lounge, with an aircraft visible through the windows.","caption":"Korean Air notified customers whose booking references were confirmed leaked by email.","description":null},"ja":{"alt":"空港の待合席でスーツケースを隣に置き、スマートフォンを確認する男性。窓の外には航空機が見える。","caption":"大韓航空は予約番号の流出が確認された対象者にメールで通知した。","description":null},"es":{"alt":"Un hombre consulta su móvil junto a una maleta en una sala de espera del aeropuerto, con un avión tras los ventanales.","caption":"Korean Air notificó por correo electrónico a los clientes cuyos códigos de reserva se confirmó que se habían filtrado.","description":null},"id":{"alt":"Seorang pria memeriksa ponsel di ruang tunggu bandara dengan koper di sampingnya dan pesawat di luar jendela.","caption":"Korean Air memberi tahu pelanggan yang kode pemesanannya dipastikan bocor melalui email.","description":null},"pt":{"alt":"Um homem consulta o celular ao lado de uma mala na sala de espera do aeroporto, com um avião ao fundo.","caption":"A Korean Air notificou por e-mail os clientes cujos códigos de reserva tiveram vazamento confirmado.","description":null},"zh-hant":{"alt":"一名男子坐在機場候機區查看手機，身旁放著行李箱，窗外可見飛機。","caption":"大韓航空已透過電子郵件通知確認訂位代號外洩的旅客。","description":null},"de":{"alt":"Ein Mann prüft sein Handy neben einem Koffer im Wartebereich des Flughafens, draußen steht ein Flugzeug.","caption":"Korean Air benachrichtigte Kunden, deren Buchungscodes nachweislich abgeflossen waren, per E-Mail.","description":null}}},{"id":2110,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6MzI0MTMsInB1ciI6ImJsb2JfaWQifX0=--d6422af70412e015e8a5815174b2bf3a9df7e712/ai-2fc90173.webp","is_representative":false,"generation_method":"ai_semi","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"집에서 옷이 담긴 여행 가방을 펼쳐 놓고 옆에 앉아 휴대전화로 통화하는 중년 여성","caption":"대한항공은 일부 고객의 예약번호 유출을 확인했으며, 추가 유출 항목은 조사 중이다.","description":null},"en":{"alt":"A middle-aged woman talks on her phone at home beside an open suitcase filled with clothes.","caption":"Korean Air confirmed that some customers’ booking references were leaked; any additional leaked data remains under investigation.","description":null},"ja":{"alt":"自宅で衣類の入ったスーツケースを開き、その横に座って携帯電話で話す中年女性","caption":"大韓航空は一部顧客の予約番号の流出を確認し、それ以外の流出項目は調査中としている。","description":null},"es":{"alt":"Una mujer de mediana edad habla por teléfono en casa junto a una maleta abierta con ropa.","caption":"Korean Air confirmó la filtración de referencias de reserva de algunos clientes e investiga si se filtraron otros datos.","description":null},"id":{"alt":"Perempuan paruh baya menelepon di rumah sambil duduk di samping koper terbuka berisi pakaian.","caption":"Korean Air mengonfirmasi kebocoran kode reservasi sebagian pelanggan dan masih menyelidiki data lain yang mungkin bocor.","description":null},"pt":{"alt":"Uma mulher de meia-idade fala ao telefone em casa, sentada ao lado de uma mala aberta com roupas.","caption":"A Korean Air confirmou o vazamento de códigos de reserva de alguns clientes e investiga se outros dados foram expostos.","description":null},"zh-hant":{"alt":"一名中年女子在家中坐在裝有衣物的敞開行李箱旁，用手機通話","caption":"大韓航空已確認部分客戶的訂位代號外洩，是否涉及其他資料仍在調查中。","description":null},"de":{"alt":"Eine Frau mittleren Alters telefoniert zu Hause neben einem offenen Koffer voller Kleidung.","caption":"Korean Air bestätigte das Datenleck bei Buchungscodes einiger Kunden und untersucht, ob weitere Daten betroffen sind.","description":null}}}],"published_at":"2026-10-24T17:27:53+09:00","updated_at":"2026-10-24T17:27:53+09:00","license":"cc_by","translation_status":"reviewed","available_locales":["ko","en","ja","es"],"data_locales":["ko","en","ja","es","id","pt","zh-hant","de"],"url":"https://injoys.com/en/articles/korean-air-data-breach-booking-number-notice"}