Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack

Hong Kong flag carrier Cathay Pacific Airways has revealed that personal data and flight details of 53,000 bookings were compromised after hackers breached its technology service provider's system.

The carrier is among hundreds of airlines worldwide that use technology solutions provided by Amadeus IT Group.

Cathay said on Friday that the unauthorised access took place between August 2023 and September 2026.

"We apologise to our customers for the concern and inconvenience caused by this incident," the company said.

In most cases, information such as booking references, passenger names and flight details was compromised.

Some cases also had additional personal data - such as email addresses, phone contacts, travel documents and frequent flier numbers - that might have been accessed. However, Cathay said there was no evidence that financial or payment information was accessed.

The airline said Amadeus confirmed that it had taken action to contain the incident, including a password reset, and had implemented enhanced monitoring and detection capabilities on its systems.

To date, Amadeus has not identified evidence that the affected data has been misused.

Cathay said it took the protection of personal data "extremely seriously" and had informed the relevant authorities of the incident.

It added that the incident had not affected its systems or operations.

The South China Morning Post has contacted privacy watchdog the Office of the Privacy Commissioner for Personal Data for comment.