Threat Intelligence · Privacy
Cathay Pacific says 53,000 bookings hit by airline data breach
Cathay Pacific says unauthorised access to Amadeus IT Group systems exposed data from 53,000 bookings. Most records included names and flight details; some may include contact or travel document info.
Ross Grant2 min read
The short version
Cathay Pacific, a major airline, says hackers got into a system run by Amadeus, a company that handles flight bookings. About 53,000 bookings were affected, with names, flight details and sometimes contact or travel document info exposed. If you flew with Cathay Pacific since August 2023, keep an eye out for suspicious emails or messages. The company is contacting affected customers.
By the numbers
- 53,000bookings affected by the breachBloomberg
- 3 yearsduration the breach went undetected (August 2023 to September 2026)Bloomberg
What happened?
Cathay Pacific says about 53,000 bookings were affected by unauthorised access to reservation data held by Amadeus IT Group between August 2023 and September 2026. Most records included booking references, passenger names and flight details; some may have included contact details and travel document information. Only Bloomberg has reported this so far, and no other airlines have been named.
Who is affected
Cathay Pacific Airways, a major airline based in Hong Kong, has reported that about 53,000 of its bookings were affected by a data breach. The incident involves reservation data held by Amadeus IT Group, a large software provider used by airlines worldwide. The breach took place over a long period, from August 2023 to September 2026, according to Bloomberg (opens in a new tab). It is not clear if other airlines using Amadeus were also affected, but Cathay Pacific is the only one named so far.
What was taken
Cathay Pacific said that most of the affected records included booking references, passenger names and flight details. For a smaller number of bookings, the exposed data may also include email addresses, phone numbers and travel document information. Travel document information could mean passport numbers or other ID details, which are sensitive and can be used for identity theft. The company has not said exactly how many people had these extra details exposed.
How the attack worked
The breach involved unauthorised access to reservation data stored by Amadeus IT Group. The details of how attackers gained access have not been made public. There is no information yet on whether the attackers exploited a technical vulnerability, used stolen credentials, or relied on social engineering (tricking staff into giving access). The breach went undetected for over three years, which raises questions about monitoring and detection at both Cathay Pacific and Amadeus.
The response
Cathay Pacific disclosed the breach in a public statement, as reported by Bloomberg. The company said it is working to understand the full impact and is contacting affected customers. There is no information yet on what steps Amadeus is taking or whether regulators are involved. Cathay Pacific has not said if it is offering support such as credit monitoring to affected passengers.
What you should do
If you have booked a flight with Cathay Pacific since August 2023, watch for any communication from the airline. Be alert for phishing emails or calls pretending to be from Cathay Pacific or Amadeus. Do not share personal information or booking details unless you are sure you are speaking to the real company. If you believe your travel document information was exposed, consider monitoring for signs of identity theft and contact the airline for advice.
Why it matters
Airline booking data includes sensitive information that can be used for identity theft or targeted scams. A breach affecting a major provider like Amadeus could have wider implications for the travel industry.
Key points
- Cathay Pacific says 53,000 bookings were affected by a data breach.
- Most records included names, booking references and flight details.
- Some records may also have included contact or travel document information.
- The breach involved Amadeus IT Group, a major airline software provider.
- The breach went undetected for over three years.
Sources
Bloomberg
Reference
