An intrusion into Amadeus IT Group’s reservation systems reached records tied to about 53,000 Cathay Pacific bookings, with passenger and itinerary information involved but no evidence so far of payment data access, the airline said.
Cathay said the activity spanned August 2023 through September 2026 and involved credentials assigned to an Amadeus system account. Amadeus alerted the airline on Oct. 28 and sent more information on Oct. 29, Cathay said. The figure counts bookings, not a confirmed number of individual travelers.
The records generally included a reservation reference, a passenger’s name and flight itinerary. A smaller, uncounted group may also have contained email addresses or phone numbers, travel document details, or frequent flyer numbers. Cathay said it had found no evidence that financial information was accessed or that the data had been misused.
Cathay said Amadeus changed a password and added measures to its monitoring and detection systems. The airline reported that its own systems and operations were unaffected and that it had notified relevant authorities. Its investigation is continuing, and it plans to contact affected customers individually after identifying the relevant records; it has not set a notification date.
Japan Airlines reported about 92,000 affected customers, and All Nippon Airways (ANA) reported about 37,800 in separate disclosures involving Amadeus systems. The three airlines’ notices do not establish a combined count of unique customers. Cathay said Amadeus’ technology serves hundreds of airlines.
