Breaches

Amadeus account breach exposes Korean Air and Asiana booking data

A valid login on Amadeus’s airline platform exposed Korean Air and Asiana booking data, possibly since 2023. What UK travel firms should check.

Padlock graphic with the headline One supplier login exposes two airlines

Someone logged into an account on Amadeus IT Group’s airline platform with valid credentials and exposed Korean Air and Asiana Airlines booking data, possibly over a period of three years. Nobody broke into either airline’s own systems, and that is exactly why every UK organisation that hands customer data to a shared travel or SaaS platform should pay attention.

What happened

Korean Air says Amadeus formally notified it late on the evening of Tuesday 20 October that it had found signs of a personal data leak. Asiana Airlines was told the same night. Both Korean carriers run their bookings on Amadeus platforms, which serve carriers, travel agencies and hotel groups around the globe.

According to the airlines’ accounts, reported by the Herald Business, ChosunBiz and MoneyToday, the intrusion came through unauthorised use of login credentials belonging to an account inside the Amadeus system. The estimated window for the activity runs from August 2023 to September 2026.

On Friday 23 October Korean Air emailed affected customers to apologise. It confirmed that booking reference numbers were among the exposed data, and warned that it would write again if Amadeus found further categories of personal information. Asiana confirmed that reservation-related details had been compromised. It said payment information was not exposed because ticket payments run on a separate system. Neither carrier has said how many passengers are affected.

The airlines say Amadeus has cut off the unauthorised access and started monitoring the dark web for the data. Korean Air says it has asked the supplier for stronger safeguards, plans an on-site inspection of Amadeus, and will review all of its external vendors. I found no public statement from Amadeus itself, so these details come via the airlines.

The technical picture

This was not an exploit, a zero-day or ransomware. According to the airlines, someone signed in. A credential issued for one account in a multi-tenant reservation platform was apparently enough to reach customer booking records.

A few points stand out. First, the exposed data matters more than it looks. A booking reference combined with a passenger surname is usually all an airline website needs to let someone view, change or cancel a trip. The airlines have not said what other fields were reachable, so treat assumptions about passport or contact data as unconfirmed. Even so, a valid booking code paired with a real itinerary is excellent raw material for convincing phishing, refund fraud and social engineering of call centres.

Second, the airlines’ own environments were never touched. Korean Air stresses that its internal systems and databases show no sign of compromise. That is accurate, but beside the point. The data lived with the supplier, the supplier’s identity controls were the weak link, and the airline’s own monitoring was not positioned to see the activity. That is the textbook shape of a third-party breach.

Third, the length of the possible window points to a gap in how long-lived accounts are governed. We do not yet know whether the credential belonged to an Amadeus employee, a contractor, an airline user or an integration. In my experience, though, the accounts that stay quietly abused for years are usually shared logins, service accounts or partner accounts without strong multi-factor authentication. Nobody reviews their activity because nobody clearly owns them.

Timeline of the Amadeus breach from the estimated August 2023 start to customer notification on 23 October 2026

Why it matters for UK organisations

Nothing reported so far suggests that UK airlines, UK passengers or any carrier other than Korean Air and Asiana were affected.

The UK relevance is structural. A CAPA headline reports that British Airways chose Amadeus’s Passenger Revenue Accounting solution, which shows a UK customer relationship but says nothing about this incident or whether BA uses the affected system. Amadeus also supplies software to travel agencies and hotels. When a large share of an industry runs on one shared platform, a weakness in that platform’s account controls becomes everyone’s risk at once. As The Korea Times noted, Amadeus has been a single point of failure before: a 2017 network fault at the company disrupted check-in at airports around the world.

The legal position matters too. Under UK GDPR, a UK airline or travel firm that uses a platform like this is normally the controller for its passengers’ data, and the supplier is the processor. If a processor suffers a breach, the controller still has to assess risk to individuals and, where required, report to the ICO within 72 hours of becoming aware. The processor must tell you without undue delay, and your Article 28 contract can make that more precise. Does yours define it in hours?

Lastly, travellers are an obvious target. Any UK organisation whose staff fly Korean Air or Asiana, including corporate travel teams booking through agencies, should expect well-crafted rebooking and refund lures.

Expert view

When we test organisations, the weakest identity in the estate is rarely the domain admin. It is usually the forgotten integration account, the partner portal login, or the shared credential a supplier issued years ago and nobody has rotated. Supplier platforms make this worse because the customer cannot see the controls.

What troubles me most here is the window. If access really ran from 2023 into 2026, the issue is not just that a credential leaked. It is that nobody on either side spotted unusual queries against booking data for a very long time. A shared platform holding many airlines’ passenger records should be watching for one account touching data it has no business reason to see.

I would also urge some caution on the “our systems were not breached” line, which both airlines have used. It is technically correct, and customers will rightly see it as irrelevant. You chose the supplier, so the risk is yours.

What to do now

  1. Find out your Amadeus exposure. If you are a UK airline, travel management company or agency using Amadeus products, ask your account team in writing whether your tenant or your customers’ records are in scope, and record the answer for your breach log.
  2. Audit supplier-issued accounts. List every login your staff and integrations hold on third-party platforms. Remove dormant accounts, rotate shared credentials and require phishing-resistant MFA. This maps directly to the Cyber Essentials user access control requirements.
  3. Ask for logs, not assurances. Contract for access to audit and sign-in logs for your tenant, or at least for alerts on bulk or unusual data access by your accounts.
  4. Tighten processor notification terms. Make sure Article 28 clauses set a specific notification deadline that leaves you time to meet the ICO’s 72-hour clock.
  5. Warn travellers. Brief staff who book or fly on affected carriers to treat unsolicited contact quoting a booking reference as suspicious, and to verify through official channels.
  6. Review booking-code security. Travel firms should check whether a reference number and surname alone can unlock changes or personal data, and add step-up verification for higher-risk actions.

Bottom line

One valid login on a shared airline platform appears to have exposed two carriers’ customers, possibly for years, without either airline’s defences ever being in play. So far, no UK passengers are known to be affected. The lesson is still squarely for UK organisations: your data is only as safe as your supplier’s least-watched account, so go and find out which accounts those are.

Sources

Related Posts