Korean Air

What this pass recorded. No Korean Air CUSTOMER-data breach confirmed this pass; however, in December 2025 Korean Air disclosed that personal data (names, bank account numbers) of roughly 30,000 EMPLOYEES leaked after a cyberattack on KC&D Service, a former catering subsidiary sold in 2020, and said customer data did not appear affected (Asiana disclosed a similar ~10,000-employee incident the prior week). Worth recording that South Korea's Personal Information Protection Commission is among the more active data protection regulators globally - it has pursued major platforms aggressively - so a null result in this jurisdiction is more meaningful than a null result in one without an enforcing authority. Korean Air is also a SkyTeam member and therefore inside the same alliance data-sharing architecture that made the SITA breach reach six carriers at once. Recommend a follow-up on Korean Air's post-merger integration with Asiana, which consolidates two carriers' passenger databases into one.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass; South Korea's Personal Information Protection Act (PIPA) applies domestically — one of the strictest data protection regimes in Asia, with meaningful private right of action; GDPR applies for EU passengers.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.