Injoys
The information confirmed to have been exposed in the Korean Air personal data breach is booking reference numbers for some customers. Additional types of exposed information are under investigation. Customers confirmed to be affected have been notified by email. Not receiving an email does not, by itself, confirm that a customer's information was not exposed.
The timeline is based on Korean Air's incident notice and the Newsis report dated October 23, 2026.
What has been confirmed about the exposure of booking reference numbers?
Korean Air stated that booking reference numbers for some customers were among the exposed information. This was not an announcement that all customers' information had been exposed. Information other than booking reference numbers is being checked through Amadeus IT Group.
A booking reference number is an identifier used to distinguish bookings. Exposure of a booking reference number does not mean the same thing as exposure of an entire booking record. Further confirmation is needed to determine whether names or passport numbers were also exposed.
| Category | Confirmed information | Limits on interpretation |
|---|---|---|
| Booking reference numbers | Exposure confirmed for some customers | Cannot be applied to all customers |
| Additional personal data types | Under investigation | Exposure of each type cannot be determined conclusively |
| Total number of people affected | No specific number given in the official notice | No basis for estimating the number of affected people |
| Payment information | Newsis reported that it was not included in the breach | Must be distinguished from the investigation into additional data types described in the official notice |
The Newsis report stated that Asiana Airlines had also confirmed an incident involving the same provider. However, this does not mean the same people were affected at both airlines. The scope of exposure for each individual must be determined from the respective airline's notification.
Korean Air confirmed that some customers’ booking references were leaked; any additional leaked data remains under investigation.
How do the incident date and notification date differ?
The estimated period during which the incident occurred differs from the date Korean Air learned of it. The reporting date is another separate point in time. Korean Air's notice itself does not display a publication date.
| Type of date | Date or period | Meaning |
|---|---|---|
| Estimated breach period | Between August 2023 and September 2026 | Period during which the incident is estimated to have occurred |
| When Korean Air became aware | October 20, 2026, at 10:44 p.m. | When it received official notification from Amadeus |
| Newsis reporting date | October 23, 2026 | Date the incident was reported |
| Official notice publication date | Not displayed | Cannot be replaced with the reporting date or the date Korean Air became aware |
The estimated breach period does not mean that exposure continued throughout that period. Nor does it mean that every customer who flew during that time was affected. The exact timing of the incident is under investigation.
The difference between a breach at a service provider and a breach of Korean Air's own systems
The access method described in the notice involved login credentials for a system account at a service provider. A service provider is a company that handles work on behalf of another company. Amadeus handles work related to airline reservations and ticketing.
The Korean Air incident notice describes the access method as follows.
Unauthorized access using login credentials assigned to an Amadeus system account
The quoted document is Korean Air's “Notice of Personal Data (Booking Reference Number) Exposure Affecting Some Customers.”
Korean Air stated that there was no indication of a breach of its own systems or databases. This is consistent with the explanation that customer information was exposed at an external service provider. It also cannot be read as an announcement that customers' Korean Air account passwords were stolen.
Korean Air stated that it took security measures, including reporting the incident, after becoming aware of it. It said Amadeus was blocking unauthorized access and monitoring the dark web. Korean Air also requested additional protective measures and steps to prevent a recurrence.
What receiving or not receiving an email means in each situation
Korean Air has notified customers whose personal data has been confirmed so far to have been exposed. Whether an email was received cannot, by itself, establish the full findings of the investigation. The airline's policy is to notify affected customers again if additional data types are confirmed.
| Situation | What can be determined | What else to check |
|---|---|---|
| You received a genuine notification email from Korean Air | You are among those identified so far for notification | The types of your information listed as exposed in the email |
| You did not receive a notification email | Only that you have not received an email | Any additional notifications and changes to the official notice |
| You received a notice from an unclear source | Whether it is a genuine notification has not been established | The official website and the contact channels listed in the notice |
| You took a flight during the estimated breach period | Only when you used the service | Whether you are among those affected |
The official notice does not provide a separate service for individuals to check whether their information was exposed. The standard booking lookup feature also cannot be considered a service for checking whether someone was affected by the breach. Information about your own case should be checked through individual notifications and official contact channels.
