Data breach exposes personal details of 53,000 Cathay Pacific passengers; other major airlines hit
[SINGAPORE] Hong Kong-listed Cathay Pacific Airways said on Friday (Oct 30) that travel reservation records held by a third-party service provider were accessed by an unauthorised party. This makes it the latest of several major airlines to disclose that their data was compromised.
Booking references, passenger names and flight details were accessed in most of the cases, it said.
But “a smaller subset of cases” involved the potential access of additional personal information including, but not limited to, e-mail and phone contacts; travel documents; and/or frequent flyer numbers.
There is no evidence of financial or payment information being accessed, the airline said in a media statement.
Around 53,000 bookings were affected by the unauthorised access to Amadeus IT Group’s system, which occurred between August 2023 and September 2026, said Cathay Pacific.
The airline noted that it was notified on Wednesday by Amadeus, which provides technology solutions to the travel industry. Cathay Pacific received further details the next day regarding the unauthorised access by a party that used log-in credentials assigned to its system account.
The statement added that Amadeus confirmed that it took actions to contain the incident, including a password reset, and implemented enhanced monitoring and detection capabilities on its systems.
To date, Amadeus has not identified evidence that the affected data was misused, said Cathay Pacific.
The airline said that the incident has not affected and is not affecting its systems or operations, and that it informed the relevant authorities of the incident.
It stressed that it continues to investigate the incident, and will notify affected customers individually once the relevant details are established.
One of many
Several other major airlines have also disclosed their exposure to the leaks.
Korean Air and Asiana Airlines issued alerts on Oct 23 confirming that they were notified by Amadeus of the data breach on Oct 20, and that no secondary damage has been reported to date. Both parties did not reveal the number of affected customers.
JAL Group disclosed on Wednesday that some 92,000 Japan Airlines and Japan Transocean Air customers were affected by the breach.
ANA Holdings reportedly made its announcement on Thursday, later revealing that around 37,800 of its passengers’ information was leaked.
Jin Air issued a notice on Thursday that the personal information of 1,454 passengers were compromised in the incident, and that leaked data items include names, birth dates, mobile phone numbers and nationalities.
Bloomberg reported on Friday that German carrier Condor was also affected.
