Cathay Pacific says booking records linked to about 53,000 reservations were accessed in the systems of its travel-technology supplier, Amadeus. The airline said its own systems and operations were not affected.
Cathay said Amadeus reported that unauthorised people used account login credentials to access travel booking data between August 2023 and September 2026.
The data mainly involved passengers’ names, booking reference numbers and flight details. In a small number of cases, additional information was involved, including email addresses, telephone numbers, travel-document details or frequent-flyer programme numbers.
Cathay said there was no evidence that financial or payment information had been improperly accessed, and separately that it had found no evidence the affected data had been misused. Its analysis of information supplied by Amadeus is continuing.
The airline said it had notified relevant regulators and would contact affected customers individually once it had established the details. Amadeus told Cathay it had reset passwords and strengthened system monitoring and detection.
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, warned that accurate flight details could make phishing messages more convincing. If a message cites someone’s flight information and asks them to click a link or provide payment details, he advised checking through the airline’s official app or website first.