Airline Booking Data Leaked, Ships Also Threatened... Companies Reassess 'Cyber Defenses'

Aviation and logistics industries on alert after hack at external IT provider
Five domestic shipping companies adopt integrated satellite communications and cybersecurity solution

Hacking concerns that began in the financial sector have spread to the aviation, shipping and logistics industries, prompting companies to review their cybersecurity systems.

According to industry sources on October 26, Korean Air and Asiana Airlines were notified by Amadeus, a global aviation IT company, on October 20 that personal information had been exposed. The incident is believed to have involved unauthorized access after the login credentials for an account on Amadeus's system were used without permission. The breach is believed to have occurred between August 2023 and September 2026.

The information confirmed to have been exposed at Korean Air so far is customers' booking reference numbers. Both airlines said they had found no signs of direct breaches of their own systems, but are still investigating the specific scale of the damage and whether any additional information was exposed. The incident has underscored the importance of third-party security management, as a breach at an external service provider led to the exposure of airline customer information.

If misused, booking information could be used for targeted phishing or impersonation scams aimed at customers. If hackers pretend to know the details of an actual flight booking and ask customers to change a reservation, request a refund or make an additional payment, customers may be more likely to trust the fraudulent messages. If combined with additional personal information, the exposed data could also raise the risk of secondary 피해, such as account takeovers.

Hanjin Information Systems & Telecommunications, an IT affiliate of Hanjin Group, also reported that an external attacker gained unauthorized access, exposing the names and email addresses of 980 users of its IT Service Management (ITSM) website. The ITSM system handles reports of IT outages and maintenance requests. The company blocked the external access route and reset the passwords for the affected accounts. However, a hacker group claims to have also obtained additional account information and materials related to partner companies, so the actual scope of the breach remains under investigation.

Concerns about hacking are also growing in the parcel delivery industry, which holds the personal information of tens of millions of people. Companies are reviewing how they protect delivery information and manage external accounts. CJ Logistics said it encrypts delivery information entrusted to it by clients and immediately destroys it once the retention period prescribed by law expires. It also operates a security system that automatically blocks unusual access patterns, such as abnormal logins or large-scale data queries.

LOTTE Global Logistics conducts an annual review of management practices at about 1,000 partner companies that process personal information on its behalf. It checks security pledges, personal information destruction confirmation forms and training records, and helps address any shortcomings. It also monitors once a month the accounts used by delivery drivers, agencies and contractors to access personal information. Parcel delivery agencies are provided with senders' and recipients' names, mobile phone numbers and addresses solely for delivery purposes.

In the shipping industry, concerns have also been raised that vessels themselves could become targets of cyberattacks. According to industry sources, the Federal Bureau of Investigation (FBI) is investigating after obtaining information suggesting that a very large crude carrier (VLCC) owned by Hyundai Glovis and managed for safety by HMM Ocean Service was targeted in a hacking attack. Earlier this month, a Liberia-owned liquefied natural gas (LNG) carrier built by HD Hyundai Samho and managed by H-Line Shipping was also reportedly targeted in an attack suspected to be a hacking incident.

Hacking a vessel could cause damage on a different scale from the exposure of personal information. If attackers infiltrate navigation systems, including the Global Positioning System (GPS) or electronic charts, through satellite communications networks or onboard networks, location data or route guidance could be disrupted. If operational technology (OT) equipment, such as engine and cargo control systems, is also affected, vessel operations and cargo management could be disrupted. If an attack leads to the actual manipulation of systems or disruption of operations, the risk of collisions and groundings could increase. The suspension of operations by major vessels could also have knock-on effects on port operations and cargo delivery schedules.

Domestic shipping companies are working to establish response systems that integrate communications and security. After SK Shipping introduced an integrated solution combining Starlink low Earth orbit satellite communications services with cybersecurity in December 2025, five domestic shipping companies - HMM, Pan Ocean, H-Line Shipping, SK Shipping and KSS Line - signed contracts in May 2026 to receive related solutions.

Individual shipping companies are also strengthening their responses. HMM plans to build an offline backup system and improve maritime cyber resilience through external vulnerability assessments. Pan Ocean is strengthening its firewalls and expanding database access controls through its subsidiary POS SM. The focus is on adding multiple layers of defense to prevent a breach at any one point from spreading across the entire operating system in an environment where vessels, shore-based management systems and external communications networks are connected.

"We have taken steps such as granting external partners only the minimum necessary account privileges and strengthening systems to detect devices, locations and query volumes that differ from normal patterns," an industry official said. "We are also working to ensure that access can be blocked quickly and operations restored if an incident occurs."

This content was produced with the assistance of AI translation services.