Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack

Cathay Pacific Airways, the Hong Kong-based airline, has disclosed that the personal data and flight details of 53,000 bookings were compromised following a cyberattack on its technology service provider, Amadeus IT Group. The unauthorized access occurred between August 2023 and September 2026, involving hundreds of airlines that utilize Amadeus' technological solutions. Cathay expressed regret for the distress and disruption caused by the incident.

In most instances, the compromised information included booking references, passenger names, and flight specifics. However, some cases also involved additional personal data, such as email addresses, phone contacts, travel documents, and frequent flier numbers. According to Cathay, there is no evidence suggesting that financial or payment information was accessed during the attack.

Amadeus confirmed that they had taken measures to contain the incident, including resetting passwords and implementing advanced monitoring and detection systems. As of now, Amadeus has not found any evidence indicating that the affected data has been misused. The airline emphasized the significance of safeguarding personal information and promptly informed the relevant authorities about the incident. Additionally, Cathay stated that the security breach did not impact its systems or operations.