Cathay Pacific says 53,000 bookings accessed in Amadeus breach

Cathay Pacific (0293.HK) said on Friday (Oct 30) that unauthorised users accessed about 53,000 of its bookings after logging into systems run by its supplier Amadeus. The access window ran from August 2023 to September 2026, and the disclosure makes the Hong Kong flag carrier the latest airline caught up in the travel-technology company's breach.

Cathay learned of the incident on Oct 28. Amadeus had notified Korean Air eight days earlier and Japan Airlines on Oct 23. Korean Air and its subsidiary Asiana Airlines went public on Oct 23. Japan Airlines followed on Oct 28 with an estimate of about 92,000 affected customers, and All Nippon Airways has put its count at roughly 37,800.

For most of the affected Cathay records, the exposure was narrow. The airline said the majority held only a booking reference, a passenger name and flight details. A smaller number may also have included contact emails and phone numbers, travel-document details or frequent-flyer numbers. Cathay said there was no evidence that financial or payment information had been accessed, and that its own systems and operations were not affected.

Nothing was breached at Cathay itself. Citing Amadeus, the airline said someone without authorisation had used the login credentials of an account on the supplier's system to reach booking data, including Cathay-related records. That is the same mechanism Korean Air described a week earlier. Cathay said Amadeus has reset passwords, stepped up monitoring and detection, and so far found no evidence the data has been misused.

Amadeus separately told Reuters it had become aware of a vulnerability affecting a travel booking display environment. It did not say how many airlines or passengers were affected. It said there was no indication the flaw had been exploited for ransomware.

The figures are a fraction of Cathay's 2018 breach, in which data on up to 9.4 million passengers was accessed. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) warned that real passenger names and flight numbers lend credibility to scammers posing as airline customer service. It said the incident may involve more airlines and cited recent scams that used leaked passenger data, including a loss of HK$1.2 million.

That figure matches a case police disclosed on Oct 23. A retiree lost HK$1.2 million to a caller who posed as Hong Kong Airlines and knew her flight number and departure time. Police have not confirmed where the caller's information came from, and no connection to the Amadeus incident has been established.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, described the incident as a supply-chain risk rather than an intrusion into Cathay's own booking or operating systems.

Cathay said it had notified the relevant authorities and would contact affected customers individually once it finished analysing the data Amadeus supplied. It did not say when.