30th October 2026 – (Hong Kong) Cathay Pacific said today it had been told of a personal-data security incident at travel technology supplier Amadeus IT Group, S.A., after unauthorised users logged into Amadeus systems and reached booking records linked to the airline.
The carrier said it was notified on 28th October and later given further detail confirming that from August 2023 through September 2026 someone used system-account login credentials to access travel reservation data held by Amadeus. About 53,000 bookings were involved, including Cathay-related reservation records — a span of more than three years before the airline went public. Cathay stressed there was so far no evidence that any financial or payment-related information had been improperly accessed.
Citing Amadeus, Cathay said the unauthorised logins over that roughly three-year span mainly exposed booking reference numbers, passenger names and flight details. In a smaller share of cases, additional personal information was reached as well — including, but not limited to, contact emails, telephone numbers, travel-document particulars and frequent-flyer programme numbers.
Amadeus has confirmed containment steps, Cathay said, including password resets and stronger monitoring and detection on its systems. At this stage there was no finding that the affected data had been misused. The airline added that the episode had not affected Cathay’s own systems or day-to-day operations, separating the supplier incident from its flight network.
Cathay said it takes the protection of personal data seriously, has informed the relevant authorities, and is investigating while analysing the material Amadeus supplied. Once the details are established it will contact affected customers individually, and it apologised for the worry and inconvenience the incident had caused.
The disclosure underlines how airline passenger files often sit with global booking platforms that serve hundreds of carriers. Here the intrusion path was described as stolen or misused account credentials into a third-party environment rather than a direct breach of Cathay’s network — yet the window of access stretched across more than three years before the airline was formally told.
Passengers whose bookings fell in that August 2023 to September 2026 period may now wait for personal notices clarifying whether only the core booking fields were touched or whether contact, document or loyalty identifiers were among the smaller set of wider exposures. Until those letters or messages arrive, Cathay’s public line remains that payment data appears untouched, its flights and systems continue as normal, and the probe with Amadeus is still under way.
