Korean Air Data Compromised in Oracle EBS Hack

Korean Air has disclosed a data breach exposing 30,000 employee records following a cyberattack on its former subsidiary and current catering supplier, KC&D. KC&D was originally part of Korean Air but was spun off and sold in 2020. According to Korea JoongAng Daily, KC&D recently informed Korean Air that information belonging to the airline’s employees has been compromised, with hackers reportedly stealing their names and bank account numbers; customer data was not exposed.

The incident is linked to the Oracle E-Business Suite (EBS) campaign, where cybercriminals exploited EBS zero-day vulnerabilities to access data held by more than 100 organisations. While the campaign is believed to have involved a cluster of the FIN11 threat group, the Cl0p ransomware group has publicly claimed credit, naming victims on its leak site and publishing data from organisations that refused to pay a ransom. KC&D was added to the Cl0p leak site on 21 November, with the group subsequently making public nearly 500 GB of archives of allegedly stolen material.