31st October 2026 – (Hong Kong) Cathay Pacific said it had been notified by travel technology provider Amadeus that credentials linked to a system account were used by unauthorised parties to access reservation information, including records relating to the airline. The Office of the Privacy Commissioner for Personal Data confirmed it has received Cathay Pacific’s breach notification and has begun an investigation under established procedures.
Initial information indicates around 53,000 booking records were exposed. Potentially affected data may include passenger names, booking reference numbers and flight details, with a subset of customers also affected by exposure of contact information, travel document details, frequent‑flyer numbers and special service requests. At this stage, the regulator said it is not yet able to determine how many of the affected customers are Hong Kong residents.
Cathay Pacific said Amadeus had taken remedial steps, including password resets and enhanced monitoring and detection across its systems. Amadeus has so far found no evidence that the data accessed has been misused. According to the notification, unauthorised log‑ins occurred between August 2023 and September 2026 and involved access to approximately 53,000 reservations, primarily comprising booking references, passenger names and flight information. The companies added that there is no indication that financial or payment data were improperly accessed.