About 53,000 Cathay Pacific bookings affected by Amadeus systems breach between 2023 and 2026

Key Facts

Cathay Pacific said about 53,000 bookings linked to the airline were affected by unauthorized access to the systems of Amadeus, a booking systems provider, between August 2023 and September 2026. The company said the figure refers to affected bookings, not the number of passengers, since a booking may be linked to more than one passenger. It added that Amadeus notified it of the incident on October 28, 2026, then provided further details on October 29. The disclosure places the incident within the third-party provider’s system, not the airline’s own systems. Cathay Pacific said the incident did not affect its systems or operations.

According to Cathay Pacific’s disclosure, the unauthorized party used login credentials assigned to an Amadeus system account to access booking data. The company did not identify who the account belonged to. The reported access spanned about three years, from August 2023 through September 2026, before the airline received Amadeus’ notification in late October. The company said the information accessed included, in most cases, the booking reference, passenger name and flight details. The disclosure did not specify how many bookings fell into this larger category.

In a smaller group of cases, the information may also have included contact details, travel documents or a frequent flyer number, according to the company. Cathay Pacific did not disclose the size of this group or the distribution of the additional data types among affected bookings. It said there was no evidence that financial information or payment data had been accessed. This clarification limits the scope of the information the company confirmed was exposed, while the investigation into individual cases continues. The company had not reported any misuse of the data by then.

Cathay Pacific said Amadeus had taken steps to contain the incident, including resetting the password and strengthening monitoring and detection capabilities. It added that it had found no evidence of data misuse by then. The airline notified the relevant authorities and said it was continuing its investigation with the parties involved. The company will contact affected customers individually once details for each case have been identified. The disclosure did not specify when the investigation would be completed or provide a timeline for sending individual notifications.

The incident follows announcements by other airlines that customer data had been compromised in an incident linked to Amadeus, according to Reuters. They include Japan Airlines, which said a similar incident affected data belonging to 92,000 customers. Asiana Airlines also reported that customer data had been compromised. These announcements show that multiple companies reported data at their businesses had been affected in the incident linked to the booking systems provider. Reuters did not provide a consolidated count of the number of affected airlines or customers.

In a separate disclosure, All Nippon Airways said about 37,800 of its customers were affected, including about 36,100 whose basic booking data was involved, and about 1,700 whose data may also have included email addresses, phone numbers and passport numbers. The company said card data and passwords were not involved in the incident. It added that the compromised login credentials had been revoked and monitoring protocols significantly strengthened. It urged customers to be alert to phishing attempts and said it would contact those affected directly. Its announcement adds separate figures for affected customers to reports from other airlines linked to Amadeus.

Reuters said investigations into the incident were ongoing and that Amadeus reported no indication the vulnerability had been exploited for ransomware purposes. The agency also said Amadeus had reported learning of a vulnerability in an environment for displaying travel bookings, but did not answer a question about the number of affected airlines and customers. In trading on October 30, 2026, Cathay Pacific shares rose 3.14% and closed at 13.79 Hong Kong dollars, according to market data. These figures describe the share’s movement during the session and do not establish a link to the breach announcement. The next step announced by the airline remains completing the investigation and identifying booking details before notifying the relevant customers individually.