Passengers whose Cathay Pacific bookings were exposed in an Amadeus breach may be vulnerable to airline-themed scams, since records commonly included names, booking references and flight details, while a smaller group included contact and travel-document information.
Cathay Pacific said an unauthorised party used login credentials assigned to a Cathay Pacific system account to enter Amadeus IT Group’s system. The access took place between August 2023 and September 2026, compromising approximately 53,000 Cathay Pacific bookings.
The airline was notified on 28 October and received further information the following day. It announced the breach on 30 October.
Most of the affected records contained booking references, passenger names and flight details. In a smaller subset of cases, the information potentially accessed also included email addresses, phone numbers, travel documents and frequent flyer numbers. There is no evidence that financial or payment information was accessed.
Amadeus reset passwords and strengthened its monitoring and detection capabilities as part of efforts to contain the incident. The company has not identified evidence that the affected information was misused. Cathay Pacific’s own systems and flight operations were unaffected.
The breach reached beyond Cathay Pacific. Japan Airlines said approximately 92,000 customer records were exposed, while ANA Holdings said information relating to around 37,800 passengers was leaked. Korean Air and Condor also confirmed that their data was affected. Jin Air said 1,454 passengers had personal information compromised, including names, birth dates, mobile phone numbers and nationalities.
The scale reflects Amadeus’s role in airline technology. Cathay Pacific is among hundreds of airlines worldwide that use the company’s technology solutions. More than 130 airlines use Altéa, Amadeus’s full-service passenger technology platform.
Recent scams in Hong Kong have involved fraudsters posing as airline customer-service staff, telling people that flights had been cancelled and offering refunds or alternative flights. Victims were directed to fraudulent websites, asked to enable screen sharing or told to transfer money for supposed verification.
Cathay Pacific said it would contact affected customers individually after establishing the relevant details.
Comments (0)