Credential-based unauthorised access to Amadeus reservation account exposes Korean Air and Asiana customer data — third-party-provider risk in aviation

Subject: Korean Air, Asiana Airlines, Amadeus IT Group  |  October 26, 2026  |  Incident window: Aug 2023 – Sep 2026 (estimated)  |  Status: Investigation ongoing  |  Vector: Third-party provider credential compromise

Credential-based unauthorised access to an Amadeus reservation account exposes Korean Air and Asiana customer data — third-party-provider risk in aviation

By Beyond Cloud Threat & Vulnerability Research  ·  26 October 2026  ·  ~7 min read

Executive summary

The Korean Air breach disclosed on 25 October 2026 exposed customer reservation data through Amadeus IT Group, the global provider of airline reservation and ticketing systems that both Korean Air and Asiana Airlines rely on. Korean Air stated that some exposed data included customer booking reference numbers. Asiana stated that reservation-related information was compromised but payment data was not affected, because its payment flow runs on a separate transaction system. Both airlines said they found no evidence of a breach of their own internal systems or databases. [1]

The reported attack vector is unauthorised access using login credentials assigned to an account in Amadeus’ system. The estimated incident window spans August 2023 to September 2026, a multi-year dwell time; investigators had not established the exact timing at the time of reporting. Amadeus notified the airlines on a Tuesday; the airlines disclosed publicly the following week. Scope — the number of customers and records affected — was not disclosed. [1]

This is a third-party-provider incident rather than an intrusion into either airline’s own estate. The event matters to Beyond Cloud customers in two ways: directly, for any customer with reservations handled through Amadeus or similar GDSs in the exposure window; and indirectly, as a reference case for third-party-provider risk in BFSI, retail, logistics and any sector that routes customer transactions through a shared vendor platform.

At a glance

Attribute	Detail
Primary affected customers	Korean Air, Asiana Airlines
Third-party source	Amadeus IT Group (reservation and ticketing systems)
Incident window (estimated)	August 2023 – September 2026; exact timing under investigation
Public disclosure	October 25, 2026 (airlines)
Reported access vector	Credential-based unauthorised access to an account in Amadeus’ system
Data categories exposed	Booking reference numbers (Korean Air); reservation-related information (Asiana, unspecified)
Payment data	Reported not affected by Asiana (separate transaction system). Korean Air not stated.
Scope	Not disclosed
Threat actor attribution	None reported
Ransom demand	None reported
Internal airline systems	No evidence of breach reported by either airline

Incident narrative

Public reporting is thin on technical detail; the paragraphs below reflect what has been stated and flag what is inferred.

What happened

Amadeus notified Korean Air and Asiana of the Korean Air breach, confirming that one or more accounts in its reservation and ticketing system had been accessed without authorisation using assigned login credentials. The access exposed reservation data belonging to customers of both airlines. Both carriers are tenants of the same Amadeus platform; a single provider-side incident therefore has multi-tenant blast radius across its airline customers. [1]

What is known about the data

• Korean Air: exposed data includes customer booking reference numbers. Full scope of exposed fields is still under investigation.
• Asiana: reservation-related information was compromised. Specific field inventory was not disclosed.
• Payment data: Asiana explicitly stated payment data was not affected because its payment flow runs on a separate transaction system. Korean Air did not make an equivalent public statement at time of reporting.
• Internal systems: both carriers stated they found no evidence of a breach of their own internal systems or databases.

Dwell time and scale

The reported incident window is approximately three years (August 2023 to September 2026). Dwell times of this length typically indicate that the unauthorised access was not detected by native platform alerting or periodic access reviews; disclosure followed Amadeus’ notification to the airlines. Number of affected customers and records has not been disclosed. [1]

Attribution and motive

No threat actor has been publicly attributed. No ransom demand has been reported. Credential-based access to a shared reservation platform is consistent with multiple threat clusters — financially motivated data brokers, loyalty-fraud operators and state-aligned travel-tracking collectors have all been observed targeting airline reservation ecosystems in prior incidents. The absence of a public leak as of the article date neither confirms nor rules out any of these motives.

Threat model for Beyond Cloud customers

This section translates the Korean Air breach into concrete risks for customers who may be downstream of the exposure or who face analogous third-party-provider exposure patterns.

Direct exposure — customers with Korean Air or Asiana reservations in window

Any customer or employee of a Beyond Cloud tenant with Korean Air or Asiana reservations between August 2023 and September 2026 may have had reservation data exposed. Immediate practical risks:

• Targeted phishing citing legitimate booking reference numbers, routes and dates — high plausibility, defeats generic “is this a scam” training.
• Loyalty-account takeover using leaked PNR data as a knowledge-based authentication factor against carrier call centres.
• Business travel pattern inference against named executives — relevant for VIP protection programmes.
• Downstream social engineering against travel agencies, corporate travel teams and PA/EA staff of exposed travellers.

Analogue risk — your own third-party platform providers

The structural pattern in this incident — single platform shared across many customer organisations, credential issued to a tenant account, multi-year dwell on provider side, discovery not driven by tenant alerting — is not unique to Amadeus or to aviation. Equivalent exposure exists wherever a sector relies on a shared platform for a core transactional workflow:

• Payments and card processing (shared acquirer and gateway providers)
• CRM and marketing automation (shared SaaS CRMs)
• HR and payroll (shared platforms used across industries)
• Core BFSI providers (core banking, CKYC bureau, UPI switch integrators in India)
• Supply chain and logistics (shared freight-booking and customs platforms)

Where to check for exposure

Area	Assessment action
Travel data in-estate	Query corporate travel management system, expense tool and SSO IdP for Korean Air or Asiana bookings between Aug 2023 and Sep 2026. Produce a list of impacted traveller identities for targeted communication.
VIP and executive protection	Cross-reference affected traveller list against executive, board and sensitive-role rosters; apply enhanced protective monitoring for the next 90 days.
Loyalty programme security	Advise affected travellers to change loyalty passwords and review call-centre authentication questions; recommend removing booking-reference-based KBA where possible.
Email filtering for themed lures	Add inbound email detections for Korean Air- or Asiana-themed phishing citing valid PNRs, flight numbers or itinerary details to employee inboxes for 90 days.
Third-party provider inventory	Enumerate your own shared-platform providers that handle customer, employee or partner data at scale; prioritise those with multi-year access-credential lifetimes.
Access-review posture at providers	Confirm which third-party providers have published access-review and credential-rotation SLAs; where none, raise the gap with your vendor-risk function.

Recommended actions

1  Communicate with affected travellers (within 48 hours)

For every identified traveller who used Korean Air or Asiana between Aug 2023 and Sep 2026, issue a short internal advisory covering: what happened, what to be alert for (phishing citing real PNRs), what to do (change loyalty passwords, enable additional authentication where available), and where to report suspicious contact (your SOC or helpdesk).

2  Monitor for themed phishing and loyalty fraud (90 days)

• Add email detections for Korean Air- and Asiana-themed lures citing valid itinerary data.
• Monitor failed-login patterns on corporate SSO against travel-related SaaS tenants used by affected travellers.
• Alert fraud teams at any BFSI subsidiary to watch for identity-theft and travel-related loan-application fraud citing exposed identities.

3  Treat this incident as a vendor-risk forcing function

• Enumerate every third-party platform that holds customer, employee or partner data at scale.
• For each, document: data categories held, credential lifetime, rotation policy, access-review cadence, breach-notification SLA, and whether logs are made available to your SOC.
• Prioritise mitigation on providers with long-lived credentials, no shared telemetry, and no contractual notification SLA.
• Where the business depends on a single shared provider in a sector, raise the structural risk explicitly with the risk committee; this incident is a current precedent.

4  Prepare for scope expansion

Scope of the Korean Air breach — both the number of affected customers and the field inventory of exposed data — was not disclosed at initial public reporting. Expect follow-on disclosures from Amadeus or the airlines; watch for updates and be prepared to re-run the traveller-exposure query against new scope statements.

Detection and hunting guidance

No network IOCs (IPs, domains, hashes) have been published. Hunt behaviourally against your own travel-adjacent workflows and your inbound email flow. [1]

Signal	Investigation focus
Phishing citing valid itineraries	Flag inbound email referencing specific Korean Air or Asiana flight numbers, routes and dates to recipients whose travel system records those bookings in the exposure window.
Loyalty-account anomalies	Review loyalty-account logins and profile changes for affected travellers across the next 90 days; cross-check against travel system records.
Call-centre social engineering	Where your organisation operates call centres authenticating travellers, review calls citing booking references issued by Korean Air or Asiana in the exposure window.
Executive travel-pattern targeting	Cross-reference affected VIP travellers against physical-security intake for threats or stalking reports.
Credential monitoring	Watch dark-web and leak-site telemetry for “amadeus”, “korean air”, “asiana” and “pnr” keyword combinations; report sightings via your CTI function.

Confidence and caveats

• Incident existence: high confidence — publicly disclosed by both Korean Air and Asiana, reported by Korea Times.
• Vector: moderate confidence — reported as credential-based access to an Amadeus account; root cause (phishing, infostealer, misconfiguration, insider) is not publicly stated.
• Scope: low confidence — number of affected customers and specific field inventory are not disclosed. Expect scope statements to evolve.
• Attribution: none reported. Credential-based access to shared travel platforms is consistent with multiple threat clusters; no attribution is made in this note.
• Downstream airlines: moderate confidence that other Amadeus-tenant airlines may be affected but have not disclosed; a multi-tenant provider incident commonly surfaces additional affected customers in subsequent weeks.

References

[1] The Korea Times, “Korean Air breach exposes blind spot in airline cybersecurity”, October 25, 2026 — koreatimes.co.kr

[2] Amadeus IT Group corporate security notices (public page — monitor for incident-specific updates).

[3] Historical reference: 2017 Amadeus technical network failure that disrupted airport check-in services worldwide, cited in [1] as a precedent for the sector’s shared-platform dependency.

Prepared by Beyond Cloud. Reviewed October 26, 2026. This is a developing incident; revisit as further scope and technical detail are disclosed by Amadeus and the affected airlines.