Cathay Pacific has been made aware of a data security incident involving personal data processed by a third-party service provider.
Cathay Pacific was notified by Amadeus IT Group, S.A. (Amadeus), a global travel technology company that provides technology solutions to the travel industry, including hundreds of airlines worldwide, and a service provider for Cathay Pacific, on 28 October 2026, and received further details from Amadeus on 29 October 2026, regarding unauthorised access to travel reservation data in its systems by an unauthorised party using login credentials assigned to its system account. This included reservation records relating to Cathay Pacific.
According to data provided by Amadeus, around 53,000 bookings relating to Cathay Pacific were affected by the unauthorised access in Amadeus’s system, which occurred between August 2023 and September 2026. In the majority of cases, the information accessed included booking reference, passenger name, and flight details. In a smaller subset of cases, additional personal information including but not limited to email and phone contacts, travel document and/ or frequent flyer number were potentially accessed. However, there is no evidence that financial or payment information was accessed.
Amadeus has confirmed that it has taken actions to contain the incident, including a password reset, and has implemented enhanced monitoring and detection capabilities on its systems. To date, Amadeus has not identified evidence that the affected data has been misused.
The incident has not impacted and is not impacting Cathay Pacific’s systems or operations.
Cathay Pacific takes the protection of personal data extremely seriously and had informed the relevant authorities of the incident.
We are continuing to investigate the incident, including analysing the data and information provided by Amadeus, and will notify affected customers individually once we have established the relevant details.
We apologise to our customers for the concern and inconvenience caused by this incident.