2026 Cathay Pacific — about 53,000 bookings exposed through Amadeus reservation-system breach; names, flight details and some contact and travel-document data
Data compromised
For most bookings: booking reference, passenger name and flight details. For a subset: email, phone, travel-document and frequent-flyer numbers. Cathay says no payment data was involved. The count is bookings, not individuals.
Technical writeup
The company statement on cathaypacific.com (en_HK) was read in the browser. Amadeus's own notice was not found. The date is the start of the vendor access window; recordsAffected is the booking count.
Root cause
Cathay Pacific says an unauthorised party used a system-account credential to log in to the Amadeus reservation system, which Cathay uses. Amadeus notified Cathay on October 28, 2026. Cathay says its own systems were not affected. According to Amadeus, the unauthorised access ran from August 2023 to September 2026.