Loading story…
Korean Air has confirmed a data breach impacting thousands of its employees after its in-flight catering and duty-free supplier, Korean Air Catering & Duty-Free (KC&D), suffered a cyberattack. The breach resulted in the exposure of personal information, including names and bank account numbers, stored in KC&D's ERP system. KC&D, which was spun off from Korean Air in 2020, notified the airline of the incident, prompting Korean Air to issue an internal notice and report the breach to authorities. Local reports estimate that approximately 30,000 employee records were compromised, though there is no evidence yet that the stolen data has been used for fraudulent purposes.
Korean Air has advised its staff to remain vigilant for phishing attempts or fraudulent communications that may impersonate the company or financial institutions. The airline emphasized that the breach was limited to employee data and that no customer information was affected. Efforts are ongoing to determine the full scope of the leak and to prevent potential secondary damage, with employees urged to exercise caution regarding suspicious requests for financial or security information.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
On December 29, 2025, Korean Air disclosed the breach, said customer data and flight operations were not affected, and warned employees to watch for phishing and other misuse of their information. The airline also reported the incident to authorities, launched an investigation, implemented emergency security measures, reviewed partner security, and in one report severed digital ties with KC&D.
After the intrusion, the Clop ransomware gang publicly claimed responsibility for the KC&D breach and published stolen data on its leak site. One report says nearly 456 GB of data was leaked after ransom demands were not met.
Korean Air Catering & Duty-Free (KC&D), a supplier and former subsidiary of Korean Air, was compromised through its ERP environment, leading to the theft of personal data tied to Korean Air employees. The exposed information included names and bank account numbers, and reports say about 30,000 current and former employees were affected.
During 2025, the Clop ransomware group conducted a broader campaign exploiting the Oracle E-Business Suite zero-day CVE-2025-61882 to gain access to victim environments and steal data. Multiple references describe the Korean Air-related breach as part of this wider activity targeting supply chains and high-profile organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
South Korean authorities attributed Coupang’s large-scale customer data leak to **management and security control failures**, not a sophisticated external cyberattack. Investigators said a **former Coupang engineer** who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information. The incident affected roughly **33.7–34 million** customers, with exposed data reported to include **names, email addresses, phone numbers, shipping addresses, and some order history**. The breach has escalated into a cross-border legal and political dispute: multiple **U.S. investment firms** (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking **investor–state dispute settlement (ISDS)** arbitration under the **Korea–U.S. Free Trade Agreement**, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Jun 29, 2026
Coupang, South Korea’s largest online retailer, suffered a massive data breach that compromised the personal information of nearly 34 million customers. The breach, which was revealed in mid-November, led to the resignation of CEO Park Dae-jun, who cited a deep sense of responsibility for the incident and its aftermath. Coupang’s parent company appointed Harold Rogers as interim CEO, with a stated focus on restoring customer trust and stabilizing the organization. The breach has intensified scrutiny of cybersecurity practices in South Korea, a country already noted for frequent data security incidents. In response to the breach, Seoul Metropolitan Police cyber investigators raided Coupang’s headquarters, seizing devices and data to determine the cause and scope of the incident. Authorities believe the perpetrator was a Chinese former employee with privileged access, who allegedly used a stolen private encryption key to forge authentication tokens and access customer data. The incident has sparked political debate over the adequacy of South Korea’s data protection laws and raised concerns among investors, especially after it was revealed that senior executives sold shares in a preplanned sale shortly before the breach was publicly disclosed.
Jun 29, 2026