Korean Air breach exposes blind spot in airline cybersecurity

A recent data breach involving Korean Air and Asiana Airlines demonstrates the aviation industry’s structural vulnerability to cyberattacks targeting third-party IT providers.

Carriers depend on external IT system operators to manage critical operations, as they have to passenger booking and ticketing data with external partners for real-time global operation.

Last week, Korean Air and Asiana said customer reservation information had been leaked through Amadeus IT Group, a global aviation technology provider that operates reservation and ticketing systems for airlines worldwide.

The two carriers said Amadeus had notified them of the incident on Tuesday. The breach is believed to have involved unauthorized access using login credentials assigned to an account in Amadeus' system. The estimated incident window spans August 2023 to last month, although investigators have yet to establish the exact timing.

Korean Air confirmed that some customers' booking reference numbers were among the exposed information, while the full scope of the leak and the number of affected customers remained under investigation.

Asiana also confirmed that reservation-related information had been compromised, but said payment data was not affected because it uses a separate system for transactions.

Neither airline has found evidence of a direct breach of its own internal systems or databases, they said. They activated security measures after being notified and are working to prevent further damage. Amadeus is also blocking unauthorized access and monitoring the dark web, according to the airlines.

Industry officials said the incident shows how difficult it is for airlines to eliminate cybersecurity risks stemming from third-party providers in an industry that relies heavily on information sharing.

Airlines must exchange booking, ticketing and passenger information with travel agencies, partner carriers and other service providers to operate international routes and manage customer itineraries.

Building and maintaining all the necessary systems and connections independently would require substantial investment and technical resources.

Global providers such as Amadeus offer established platforms that connect airlines with the wider travel ecosystem. But when multiple carriers rely on the same provider, a security incident at that company can potentially affect customers across different airlines, creating a shared point of vulnerability.

The incident also underscores the importance of airlines monitoring the security practices of their tech partners, rather than relying solely on their own cybersecurity measures.

“Airlines face structural cybersecurity risks because they rely on external technology providers for stable operations,” an industry official said.

Korean Air said it had requested stronger safeguards and measures to prevent further issues from Amadeus. In 2017, a technical network failure affecting Amadeus systems disrupted check-in services at airports worldwide, demonstrating how problems at a shared provider can affect multiple carriers.

Korean Air faces maintenance capacity crunch from Asiana acquisition

Korean Air faces probe over deleted documents in route case