Amadeus account misuse exposes Asiana and Korean Air bookings

Amadeus account misuse exposes Asiana and Korean Air bookings

23 October 2026: Asiana Airlines says an unauthorised party used credentials assigned to Amadeus system accounts to reach passenger data, and that some of its customers' booking reference numbers (PNRs) were among what was taken. Amadeus IT Group, the Madrid-based company whose reservation and ticketing system Asiana uses, estimates the access ran from August 2023 to September 2026, and Korean Air has published a matching notice.

Not yet independently verified. This rests on Asiana Airlines' own notice; we found no statement from Amadeus on its newsroom, and Korean Air's matching notice refused our requests. Neither company has said how many passengers are affected or whether other airlines are involved. We will update this when it can be confirmed, and remove this note.

That window is the striking part. On Asiana's account, access with valid account credentials went on for roughly three years before Amadeus told its airline customers, which it did on 20 October at 10:49 pm Korean time.

What the airlines have been told

Asiana's notice says it applied initial security measures at once and found no sign that its own databases had been breached. It reported the incident to the South Korean authorities and has emailed the customers identified so far. Amadeus is still checking which other data items were exposed, and Asiana promises updates as they are confirmed.

According to the notice, Amadeus has blocked the unauthorised access and started dark web monitoring. No secondary damage had been reported when it was posted, and Asiana asks customers not to click unfamiliar links, open unknown attachments or answer requests for personal details. iThome, which reported both airlines' notices, adds that no other Amadeus customer had disclosed a breach and that no group had claimed the attack.

Why a booking reference matters

A PNR on its own looks harmless, but together with a surname it opens most airline "manage booking" pages, which show itineraries and contact details and allow changes to seats and meals. That is why exposed booking references are a familiar starting point for convincing phishing about cancelled flights or refunds. Asiana tells affected passengers they can seek dispute mediation or compensation under Articles 39, 39-2 and 43 of Korea's Personal Information Protection Act, through the Personal Information Dispute Mediation Committee.

Questions for companies that book through Amadeus

Amadeus sits under a large share of the world's airline, hotel and travel agency bookings, so the incident reaches beyond two carriers even if none has said so yet. A travel management team or agency that books through it can usefully ask its Amadeus contact which accounts were misused, whether its own office IDs or API credentials are in scope, and when the review of other data items will finish. Rotating any shared or long-lived Amadeus credentials is a reasonable precaution while that answer is pending.

We list Amadeus among IT product companies, and our travel management software category holds 20 products. The open question is whether Amadeus itself will publish the scope, and whether other airlines follow Asiana and Korean Air.

Sources

• Asiana Airlines: Notice of Personal Data Breach, 23 October 2026
• iThome: Amadeus booking system account credentials leaked, Korean Air and Asiana customer data exposed, 26 October 2026
• Amadeus newsroom (read 2026-10-26, no statement found), 26 October 2026