Cathay Pacific has recently announced that approximately 53,000 of its customer bookings were compromised due to unauthorized access to reservation data managed by Amadeus, a key technology partner. The airline emphasized that its own operational systems and internal data infrastructure were not directly affected by this security incident. This breach highlights the growing challenges faced by companies relying on third-party vendors for critical data management.
The unauthorized access transpired over a significant period, specifically between August 2023 and September 2026. Amadeus, upon detecting the intrusion, promptly informed Cathay Pacific on October 28, providing additional details the following day. Investigations revealed that an unauthorized entity gained entry by using legitimate login credentials associated with one of Amadeus's system accounts, subsequently accessing sensitive travel reservation data.
The compromised information primarily included fundamental details such as booking references, the names of passengers, and specific flight itineraries. For a smaller subset of affected individuals, the breach also extended to more personal data, including email addresses, telephone numbers, details from travel documents, and frequent-flyer account numbers. Critically, Cathay Pacific has confirmed there is no indication that any financial or payment information was accessed during this event, providing some relief amidst the concerns.
In response to the incident, Amadeus has taken immediate steps to enhance its security posture. This includes resetting the compromised password and implementing more robust monitoring and detection measures to prevent future occurrences. As of their statement on October 30, Amadeus had not found any evidence that the stolen information had been misused. Cathay Pacific is actively collaborating with relevant authorities and thoroughly reviewing all information supplied by Amadeus. The airline has committed to individually notify all affected customers as soon as comprehensive details are established.