Cathay Pacific Says Amadeus Breach Hit About 53,000 Bookings, Some Possibly With Travel Document Details

On October 30, 2026, Cathay Pacific said about 53,000 of its bookings were affected by unauthorized access to reservation data held by Amadeus IT Group, a technology provider whose customers include hundreds of airlines. The airline’s notice says the access happened between August 2023 and September 2026.

In most cases the data was a booking reference, a passenger name and flight details. In a smaller group of cases, email and phone contacts, travel document details or frequent flyer numbers were potentially accessed, and Cathay did not say how many.

What Cathay says happened

Cathay says an unauthorized party used login credentials assigned to a system account at Amadeus. Amadeus told the airline on October 28 and sent further details on October 29.

The airline says its own systems and operations were not affected, and that there is “no evidence that financial or payment information was accessed.” According to Cathay, Amadeus has reset a password, added monitoring and detection, and has not found evidence of misuse so far.

The 53,000 figure counts bookings, not people, and the notice gives no passenger total. Cathay says it will contact affected customers individually once it has established the details.

The airline, based at Hong Kong International Airport, also faces a local inquiry. Hong Kong’s privacy commissioner has received Cathay’s notification and opened an investigation under its established procedures, according to on.cc and Dimsum Daily, which also report that the office cannot yet say how many Hong Kong customers are involved.

Cathay has been before this regulator on data security. Its 2018 breach touched some 9.4 million customers, and the commissioner issued an enforcement notice against the airline in 2019, as Hogan Lovells summarized.

Several airlines, very different clocks

Cathay is not the only carrier counting. Airlines in Japan and South Korea had already described unauthorized access at Amadeus, with the same August 2023 to September 2026 period.

Airline	Told by Amadeus	Went public	Scale reported	Additional data
Korean Air	Oct. 20	Oct. 23	Not given	Booking references confirmed, other items being checked
Asiana Airlines	Oct. 20	Oct. 23	Not given	Reservation-related data, payment data not affected
Japan Airlines and Japan Transocean Air	Oct. 23	Oct. 28	About 92,000 people	About 2,000 people: contacts, passport number, nationality, mileage number
All Nippon Airways	Oct. 20	Oct. 29, count on Oct. 30	About 37,800 people	About 1,700 people: contacts, passport number, nationality, mileage number
Cathay Pacific	Oct. 28	Oct. 30	About 53,000 bookings	A smaller subset, size not given

The most detailed timeline comes from ANA. As Aviation Wire and Travel Voice report it, Amadeus detected the access on September 24 but did not tell ANA that day, and ANA learned on October 16 that other Amadeus airlines had confirmed access.

Amadeus reported to ANA on October 20. On those dates, Cathay’s October 28 notification came 34 days after the detection ANA describes, and Cathay’s notice gives no detection date of its own.

ANA also relays that Amadeus invalidated the credentials and has so far found no sign of ransomware or of data being altered or deleted. ANA has told three other Japanese carriers, Air Do, Solaseed Air and Starflyer, that personal information was viewed, and each is checking the scope with ANA.

JAL’s figures come from its October 28 announcement, reported by Aviation Wire and The Record. Korean Air’s account, including notice from Amadeus at 10:44 p.m. on October 20, was reported by MoneyToday.

Asiana said payment data was untouched because it uses a separate transaction system, per The Korea Times, and ZDNet Korea reports no direct intrusion into its own database was found. Asiana is due to combine with Korean Air on December 17, so both carriers are handling this weeks before the merger.

What a shared system means for passengers

Amadeus runs reservation, ticketing and check-in systems for JAL, according to The Record, and JAL moved to its passenger service system in November 2017, according to Aviation Wire. That is why a carrier’s own network can be untouched while its customers’ records are not: the data sits with the vendor.

This pattern has appeared before. In 2021, a breach at the airline IT provider SITA led ANA and JAL to say about 1 million and 920,000 customers may have been affected, and Cathay also confirmed involvement, as Pacific Island Times reported at the time.

For most passengers here the exposed fields are not a card number, but they are enough to make a scam sound real. Francis Fong, honorary president of the Hong Kong Information Technology Federation, told DotDotNews that names and reference numbers could be used to craft phishing emails or scam calls.

His advice is to check any airline-branded message through the official app or website rather than its link, even if the flight details are accurate. JAL, ANA and Korean Air have issued similar warnings. JAL and ANA also flag fake websites, and ANA adds social media ads that impersonate its group.

Genuine notices are also on the way, which is the awkward part. Cathay and JAL say they will contact customers individually and ANA plans to start in the first week of November, so passengers should expect real messages and imitations at about the same time.