Cathay Pacific joins airlines hit by Amadeus data breach

Hong Kong-based carrier Cathay Pacific has joined several international airlines affected by unauthorised access to a major travel technology provider's systems.

Cathay Pacific said Amadeus IT Group S.A. (Amadeus), its travel technology service provider, notified it on 28 October 2026 of unauthorised access to travel reservation data in its systems. Further details received on 29 October indicated that an unauthorised party had accessed the data using login credentials assigned to an Amadeus system account. The affected records included reservations relating to Cathay Pacific.

According to data provided by Amadeus, approximately 53,000 Cathay Pacific bookings were affected by the unauthorised access to its systems, which took place between August 2023 and September 2026. In most cases, the information accessed included booking references, passenger names and flight details. In a smaller number of cases, additional personal information, including email addresses, phone numbers, travel document details and frequent flyer numbers, may also have been accessed. However, there is no evidence that financial or payment information was compromised.

Amadeus said it had taken steps to contain the incident, including resetting passwords and strengthening monitoring and threat detection across its systems. The company added that it had not found any evidence of the affected data being misused so far.

The airline said the incident had not affected and was not affecting its systems or operations. Cathay Pacific added that it takes the protection of personal data seriously and had notified the relevant authorities about the incident.

“We are continuing to investigate the incident, including analysing the data and information provided by Amadeus, and will notify affected customers individually once we have established the relevant details. We apologise to our customers for the concern and inconvenience caused by this incident,” the airline said.

Notably, the Amadeus security incident has affected several major international airlines.

The Straits Times reported that Japan Airlines had disclosed the exposure of around 92,000 customer records in a cyberattack, while ANA Holdings said information belonging to up to 37,800 passengers had been leaked. Korean Air and German carrier Condor have also reported that their data was affected.

It is not yet known whether additional airlines have been affected, as Amadeus provides technology solutions to carriers worldwide.