Amadeus data breach hits 53,000 Cathay Pacific bookings
Travel tech firm Amadeus reported a data breach affecting about 53,000 Cathay Pacific bookings from August 2023 to September 2026. Unauthorised access involved booking references, passenger names, and flight details, with some cases exposing emails, phone numbers, travel documents, or frequent-flyer
Cathay Pacific has disclosed a data breach affecting approximately 53,000 booking records after its third-party travel technology supplier, Amadeus IT Group, S.A., reported unauthorised access to its systems. The breach occurred between August 2023 and September 2026, according to a notification received by the airline on Wednesday, with further details provided on Thursday.
Amadeus, a global travel technology solutions provider serving hundreds of airlines including Cathay Pacific, said an unidentified individual used system account login credentials to access travel booking data stored on its platform. The accessed information primarily included booking reference numbers, passenger names, and flight details. In a smaller number of cases, additional personal data such as contact email addresses, phone numbers, travel document information, or frequent-flyer programme numbers may also have been accessed.
Cathay Pacific emphasised that there is no evidence any financial or payment-related data was improperly accessed. Amadeus has taken remedial action, including resetting passwords and enhancing system monitoring and detection capabilities. The company has also found no evidence that the accessed data has been misused.
The airline said the incident has not affected its own systems or operations. Cathay Pacific has notified relevant authorities and launched an investigation. Once the full details are established, it will contact affected customers individually. The carrier apologised for any concern or inconvenience caused to its customers.