Short answer
Jin Air announced on 29 October 2026 that an outside party had abnormally accessed its member information lookup API, exposing data on 1,454 members. The airline says passwords, financial information and payment history were not included, and it reported the incident to the Personal Information Protection Commission.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Jin Air |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Airline |
| Country | South Korea |
| Detected | 2026-10-28 |
| Disclosed | 2026-10-29 |
| People or records affected | 1,454 member accounts |
What data was exposed
- Login ID
- Name, date of birth, gender and nationality
- Mobile phone number and email address
- Date and time of last login
What happened
Jin Air, a South Korean low-cost airline in the Hanjin group, said on 29 October 2026 that member data had leaked. According to The Kyunghyang Shinmun, the company detected the attack on 28 October and posted a notice on its website the next day. An outside party had abnormally accessed the API used to look up member information. The leak covers 1,454 member accounts.
What was exposed
The exposed items are login ID, name, date of birth, gender, nationality, mobile phone number, email address and last login date and time. Jin Air says passwords, financial information and payment history were not included.
What Jin Air says
Jin Air blocked the attacker’s IP addresses, cut off the system used in the attack and deleted it. It reported the incident to the Personal Information Protection Commission, set up round-the-clock emergency monitoring and said it is re-checking its systems for weaknesses. It says it has found no misuse of the data so far. Members are told not to click unknown links, download unknown attachments or enter personal information when asked.
Is it linked to other airline incidents?
The report notes that Korean Air and Asiana Airlines were told on 20 October by their vendor Amadeus IT Group of possible leaks. Our Amadeus report covers that case. Jin Air describes an attack on its own API, and we have found no source that connects the two incidents.
Why name, birth date and phone number matter
Scammers use details like these to impersonate an airline. A message that opens with your name and says a flight changed or a refund is waiting is believable. Our phishing messages guide and travel scams guide show what fake airline messages look like, and the data breach checklist lists the steps to take. More cases are on our breaches page.
What to watch next
Watch for any update to the count and any Personal Information Protection Commission decision.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts or calls posing as Jin Air about a flight change, refund or 'account verification', using your real name and phone number.
- Smishing links that imitate Jin Air login or compensation pages.
- Voice phishing that uses your birth date and nationality to build trust before asking for money or codes.
- Phishing emails sent to the address on your Jin Air account.
What to do if you are affected
- 01Do not click links or open attachments in unexpected messages about Jin Air. Open the Jin Air app or website yourself.
- 02Do not enter personal information when a message or caller asks for it. Jin Air warns members about this.
- 03Change your Jin Air password if you reuse it elsewhere, even though Jin Air says passwords were not exposed.
- 04Check any notice you receive from Jin Air against the notice on its official website.
- 05Report suspicious texts to KISA on 118 and voice phishing to the police on 112.
Frequently asked questions
What data did Jin Air say was exposed?
Login ID, name, date of birth, gender, nationality, mobile phone number, email address and last login date and time. Jin Air says passwords, financial information and payment history were not included.
How did the attacker get the data?
Jin Air says an outside party abnormally accessed its member information lookup API. It blocked the attacker's IP addresses, shut off the system used in the attack and deleted it.
Is this the same as the Korean Air and Asiana incident?
Not established. Korean Air and Asiana Airlines were told on 20 October by their vendor Amadeus of possible leaks through their systems. Jin Air's notice describes an attack on its own lookup API, and no source we reviewed links the two.
Has the data been misused?
Jin Air says it has found no misuse so far. Treat unexpected contact as suspect anyway.
Sources
- Jin Air hack exposes 1,454 members' personal data (Korean-language article, headline in English), The Kyunghyang Shinmun, 2026-10-29
- Jin Air hack leaks 1,454 members' data; third Hanjin group airline hit in a row (Korean-language article, headline in English), Newneek, 2026-10-29
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.