Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack

Cathay Pacific Airways, the flag carrier of Hong Kong, disclosed that the personal data and flight details of 53,000 bookings were accessed in a cyberattack on its technology service provider, Amadeus IT Group. The unauthorized access occurred between August 2023 and September 2026. The company expressed regret for the distress and disruption caused by the incident.

The compromised information primarily included booking references, passenger names, and flight details. However, some instances also contained additional personal data, such as email addresses, phone contacts, travel documents, and frequent flier numbers. Despite these concerns, Cathay Pacific asserted that there was no evidence of financial or payment information being accessed.

Amadeus confirmed they had taken measures to contain the breach, including resetting passwords and enhancing monitoring and detection capabilities within their systems. No evidence has been identified to suggest the misuse of the affected data. The airline emphasized the seriousness of protecting personal data and had reported the incident to the appropriate authorities.

The breach did not impact Cathay Pacific's systems or operations. The story was obtained from the South China Morning Post, which sought comment from the Office of the Privacy Commissioner for Personal Data.