Cathay Pacific has reported that unauthorised access to reservation data held by Amadeus affected about 53,000 of its bookings. The access, which took place between August 2023 and September 2026, involved credentials assigned to a system account at the travel technology provider. The airline’s own systems and operations were not affected, and there is no evidence that payment information was accessed or that the data has been misused.
Most affected records contained booking references, passenger names and flight details. A smaller subset may also have included email addresses or phone numbers, travel-document information or frequent-flyer numbers. The precise records affected remain under investigation.
Amadeus notified Cathay on 28 October and provided further details the following day. The provider reset a password and strengthened monitoring and detection on its systems. Cathay is analysing the information supplied by Amadeus and has informed relevant authorities; it plans to notify affected customers individually once it has established which records were involved.
The reported booking count and access details are based on information from Amadeus. Cathay had not completed its own analysis when it disclosed the incident on 30 October.