Cathay Pacific says Amadeus breach exposed data from 53,000 bookings

On 30 October 2026, Cathay Pacific — Hong Kong's flag carrier, based at Cathay City on Hong Kong International Airport — disclosed that passenger information from approximately 53,000 of its flight bookings had been exposed through a breach at its reservations technology provider, Amadeus. The airline said the intrusion did not affect its own systems and stemmed entirely from unauthorised access at the third party.

What happened

According to Cathay, an attacker used an Amadeus system-account login to reach reservation records spanning August 2023 to September 2026. Amadeus notified Cathay of the incident on 28 October 2026 and supplied further details the following day. How the credentials were obtained, and when the intrusion was first detected, were not disclosed. Cathay stressed that its own IT environment was unaffected, underscoring that the exposure originated in the shared third-party platform rather than in the airline's infrastructure.

What was exposed

Most of the affected records contained booking references, passenger names and flight details. A smaller subset may also have included email addresses, phone numbers, travel document information or frequent-flyer numbers. Cathay said it had found no evidence that payment or financial information was accessed. The company noted that the figure of roughly 53,000 counts bookings rather than individuals, and that it had not yet established how many distinct travellers were affected.

A sector-wide incident

The Amadeus compromise was not limited to Cathay. Several other carriers that rely on the same reservations system reported exposed passenger data in the same window, including Japan Airlines — which said data on about 92,000 of its and subsidiary Japan Transocean Air's customers was leaked — All Nippon Airways, Korean Air, Asiana Airlines and others. Amadeus said it had contained the incident, reset the affected password and strengthened its security monitoring. Cathay said it had notified the relevant authorities and would contact affected customers individually once their details were confirmed.