Korean Air

Korean Air is the flag carrier airline of South Korea, operating under the legal name Korean Air Lines Co., Ltd. It provides scheduled passenger transportation and air cargo services to a network of domestic and international destinations. The airline's primary hub is Incheon International Airport near Seoul, from which it connects to cities across Asia, Europe, the Americas and Oceania. In addition to flight operations, Korean Air has historically been involved in ancillary aviation services such as aircraft maintenance, ground handling and, through subsidiaries, airline catering and duty‑free retail.

The company's catering and duty‑free activities were formerly carried out by a subsidiary that supplied meals and retail products to many airlines worldwide. In November 2025, Korean Air disclosed that hackers accessed personal information of approximately 30,000 current and former employees after breaching that former subsidiary. The compromised data consisted of names and bank account numbers, while customer records remained unaffected. The intrusion was linked to a widespread Oracle E‑Business Suite zero‑day exploit campaign that has affected over a hundred organizations, with the Cl0p ransomware group claiming responsibility and publishing roughly 500 GB of data taken from the subsidiary on its leak site.

As South Korea's flag carrier, Korean Air holds a distinctive position in the national aviation sector, representing the country in international air transport agreements and participating in global airline alliances such as SkyTeam. The airline maintains a dedicated cargo division, Korean Air Cargo, which operates freighter aircraft and utilizes belly‑hold capacity on passenger flights to move goods across continents. Its operational competencies include long‑haul flight operations, aircraft maintenance engineering and a safety‑focused culture regulated by the Ministry of Land, Infrastructure and Transport of South Korea.

Structurally, Korean Air Lines Co., Ltd is a publicly listed corporation whose shares are traded on the Korea Exchange. The incident involving the former catering and duty‑free subsidiary highlights the organization's exposure to supply‑chain risks, particularly through third‑party service providers that handle non‑core functions. The breach also underscores how aviation‑related entities can be caught in broader cyber‑crime campaigns that target widely used enterprise software, as demonstrated by the Oracle E‑Business Suite zero‑day exploit that simultaneously affected companies such as Envoy Air and numerous other sectors.