Several travel-related personal data leaks came to light in late October. Travel platform MyRealTrip confirmed on the 25th that user data had been taken through unauthorized outside access, and for some users this included passport numbers and passport expiry dates. Jin Air confirmed on the 28th that data on 1,454 members had leaked, and Korean Air and Asiana Airlines were notified on the 20th by their reservation and ticketing system provider Amadeus of signs of a leak.

MyRealTrip and Jin Air said payment information was not among the leaked items, and Asiana said payment data was not included because it uses a separate system. But since names, phone numbers and emails were exposed, follow-up scams by text or email impersonating these companies are possible. This article is based on October 23–29 reports by Yonhap News, Dong-A Ilbo and Maeil Business Newspaper, including the company notices they cite.

At a glance

What leaked: items by company

At MyRealTrip, names, emails, mobile numbers, dates of birth, gender and encrypted passwords leaked, and for some users passport numbers and passport expiry dates as well. The company said payment details such as credit cards, and booking and purchase history, were not included. The number of people affected and how the intruder got in were not disclosed.

At Jin Air, an abnormal outside attack on its member-lookup API exposed user IDs, names, dates of birth, gender, nationality, mobile numbers, email addresses and last login times. Passwords, financial information and payment history were not included, and the airline said no misuse had been confirmed so far.

The Korean Air and Asiana case did not involve the airlines' own systems but unauthorized access using login credentials for an account on the system of their contractor Amadeus. Korean Air customers' booking reference numbers were included, and Asiana also said booking-related data leaked. The incident is estimated to have occurred between August 2023 and September this year, and as of checking, the scale and items were still under investigation.

Who is affected

MyRealTrip users, Jin Air members, and anyone who has booked with Korean Air or Asiana. MyRealTrip said leaked items can differ by user and lets you look up on its website whether your data and which items were exposed. Korean Air and Asiana sent notice emails to customers and plan to notify them again as more details are confirmed.

Reports noted that around 200 airlines worldwide use the Amadeus system, so more leaks could come to light or the scope could widen.

What to do: check and change

First check the notice on the website or app of the company you used to see whether your data is included. MyRealTrip users can see in the leak lookup whether their passport number was involved. The companies recommended changing your password. If you use the same password on other travel or shopping sites, it is safer to change those too.

MyRealTrip said affected users can seek remedies through procedures such as claims for damages or applying for personal information dispute mediation. Jin Air reported the incident to the Personal Information Protection Commission, and MyRealTrip said it also reported to the relevant authorities.

Watch out: texts and calls using company names

Leaked names, phone numbers and emails can be misused for identity theft, voice phishing and smishing. The companies urged customers not to click links from unclear sources, not to download attachments and not to respond to requests for personal information. For messages tied to your trip, such as booking confirmations, refunds or passport detail checks, go directly to the official app or website instead of tapping the link in the message.

The reports and notices we checked did not include any guidance on reissuing passports. For any passport-related steps, check the Ministry of Foreign Affairs passport information and the companies' follow-up notices.

Pre-departure checklist