Korean Air discloses data breach after the hack of its catering and duty-free supplier

Korean Air disclosed a data breach linked to the hack of its catering and duty‑free supplier, KC&D Service, with personal data belonging to around 30,000 of its employees affected. The airline said no customer data appears to have been compromised and that it has implemented emergency security measures, notified authorities, and is reviewing security protocols with partners to prevent recurrence.

A notice from KC&D stated that personal information stored on KC&D’s ERP server was leaked during the incident, and Korean Air emphasised its seriousness given the involvement of employee data. The company did not attribute the attack to a specific threat actor, but according to Korea JoongAng Daily, the Clop ransomware group has claimed responsibility for the KC&D attack in November and added KC&D to its Tor data leak site.

Clop has been linked to exploiting the Oracle E-Business Suite zero‑day CVE-2025-61882 among other campaigns. Korean Air’s investigation continues to determine the precise scope and targets of the leak, with staff warned to watch for suspicious messages.