Amadeus data breach affects 53,000 Cathay Pacific bookings

Cathay Pacific Airways has disclosed that a data breach involving Spanish software provider Amadeus IT Group affected approximately 53,000 flight bookings. The airline reported that the unauthorized access occurred between August 2023 and September 2026, according to information provided by Amadeus.

Details of the Cathay Pacific Breach

Cathay Pacific stated that the airline was notified of the security incident on October 28, 2026, and received additional details on October 29. The airline confirmed that the breach did not affect its own internal IT systems or flight operations.

In most cases, the compromised information included passenger names, booking reference codes, and flight details. In a smaller number of cases, additional personal information was exposed, which may have included email addresses, telephone contacts, travel document details, and frequent flyer membership numbers. Cathay Pacific emphasized that it has found "no evidence that financial or payment information was accessed". The airline said it has informed the relevant authorities and plans to notify affected customers individually once details are established.

Amadeus Response and Technical Details

Amadeus acknowledged identifying a vulnerability affecting a travel booking display environment. According to reports, the unauthorized party accessed reservation information using login credentials assigned to a system account.

Amadeus stated that it has taken steps to contain the impact of the incident, which included implementing password resets and strengthening its system monitoring and threat detection capabilities. The company stated it has found no indication that the vulnerability was exploited to carry out a ransomware attack, and it has not identified evidence that the affected data has been misused.

Impact on Other Global Airlines

The breach has affected several other major international carriers that utilize Amadeus technology. Reported impacts include:

• Japan Airlines: Reported that approximately 92,000 customer records were affected by unauthorized access to Amadeus systems.
• ANA Holdings: Disclosed that information relating to approximately 37,800 passengers was exposed.
• Jin Air: Disclosed that personal information relating to 1,454 passengers was compromised.
• Other Carriers: Asiana Airlines, Korean Air, and Germany’s Condor have also been identified as having customer data compromises linked to the incident.

While these figures represent separate airline-specific impacts, the combined total of affected booking or passenger records for Cathay Pacific, Japan Airlines, ANA Holdings, and Jin Air is at least 184,254.

Why it matters

The incident highlights the cybersecurity risks associated with third-party technology systems used by the aviation industry. Because many airlines depend on shared reservation platforms, a single vulnerability in a provider's infrastructure can expose data for multiple enterprise customers simultaneously.

---

Sources

• idnfinancials.com: Amadeus data breach affects 53,000 Cathay Pacific bookings | IDNFinancials
• infotechlead.com: Amadeus Cyberattack Exposes 53,000 Cathay Pacific Bookings, Affects Japan Airlines and Other Global Carriers - InfotechLead
• bangladeshmonitor.com.bd: Amadeus data breach exposes 53,000 Cathay Pacific bookings
• aviationa2z.com: Cathay Pacific Confirms Data Breach Affecting 53,000 Bookings, Passenger Details Exposed - Aviation A2Z
• ftnnews.com: Amadeus Breach Affects 53,000 Cathay Pacific Bookings
• bangkokpost.com: Bangkok Post - Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.