Cathay Pacific says unauthorized access to reservation records held by Amadeus affected around 53,000 bookings relating to the airline. Its October 30, 2026 disclosure, updated at 4:11 p.m. Hong Kong time, says it was notified on October 28 and received further details the following day.
The access occurred between August 2023 and September 2026, according to information Amadeus supplied to Cathay. The published figure counts bookings; the notice does not give a distinct affected-passenger total.
What information was involved?
Cathay says most cases involved booking references, passenger names and flight details. A smaller subset potentially involved further information, such as contact details, travel-document information or frequent-flyer numbers. It reports no evidence that financial or payment information was accessed.
The airline says its own systems and operations are unaffected. It reports that Amadeus contained the incident, reset a password and enhanced monitoring, and had identified no evidence of misuse of the affected data.
Customer notification and checks
Cathay says it informed the relevant authorities and is continuing to investigate and analyse the supplied information. It will notify affected customers individually once the relevant details are established.
Customers checking a message about this disclosure should open Cathay’s website independently and use its official contact channels. A correct name or itinerary in an unexpected message is not enough to establish who sent it. Avoid sharing booking references or travel-document details in public comments, and check requests for information before responding.
The notice does not mean every Cathay booking is affected or that every affected record contained the same information. Keep the date of a disclosure separate from the earlier period when access occurred.
Related: JAL/JTA and other Japanese airline reservation-data notices. Their reported totals describe separate airline disclosures and should not be combined with Cathay’s booking figure.
