Cathay Pacific: about 53,000 bookings affected in the Amadeus breach
Cathay Pacific said on October 30, 2026 that the breach at its third-party provider Amadeus affected about 53,000 bookings: booking references, passenger names and flight details in most cases, with email addresses, phone numbers, travel document information and frequent flyer numbers in a smaller subset; the airline says there is no evidence financial or payment information was accessed.
What happened
On Friday, October 30, 2026, Cathay Pacific said a data security breach at Amadeus, the Spanish company that provides its reservation technology, affected about 53,000 of its bookings. The airline said it was notified of the incident by Amadeus on October 28 and received further details the following day. According to the airline’s statement, the unauthorised party used login credentials assigned to an Amadeus system account, and the bookings affected date from August 2023 to September 2026. Cathay Pacific said the incident did not affect its own systems or flight operations, that it has informed the relevant authorities, and that its investigation is continuing. Amadeus has reset passwords and strengthened monitoring and detection on its systems.
This is the same Amadeus incident this desk covered on October 28, when Japan Airlines disclosed that reservation data for about 92,000 of its customers may have been viewed (see the Japan Airlines report). Cathay Pacific is the latest airline to put its own figure on the shared incident, and Amadeus has not said how many airlines or customers are affected in total.
Who is affected
People with about 53,000 Cathay Pacific bookings made between August 2023 and September 2026. In the majority of cases, the information accessed was the booking reference, the passenger name and the flight details. In a smaller number of cases, the records also included email addresses, phone numbers, travel document information and frequent flyer numbers. Cathay Pacific said there was no evidence that financial or payment information was accessed, and Amadeus said there were no indications the vulnerability had been exploited for ransomware. The airline said it has not identified evidence that the affected data has been misused.
Amadeus had already disclosed part of the picture itself: on October 1, 2026 it published a statement saying it had discovered a vulnerability in its travel booking display environment that could expose travellers’ data, and the Japan Airlines disclosure showed the same system had been accessed over a period running from August 2023 to September 2026. Amadeus told Reuters the investigations are ongoing and that there are no indications the vulnerability has been exploited for ransomware purposes. It did not answer how many airlines or customers are affected in total, so the full scope of this incident is still emerging airline by airline.
How serious
The concrete risk is targeted phishing and travel scams, not card fraud: a booking reference together with a passenger’s name and real flight details is exactly what a scammer needs to sound like the airline — for example, a fake “your flight has changed, pay the difference” message that quotes a genuine booking. For the smaller subset whose travel document information was included, there is an added identity-misuse risk, because passport details are hard to change. No passwords or payment details were reported taken, so account takeover of a Cathay Pacific account is not the direct risk here; the exposure is the booking itself.
What to do now
Treat any message about a Cathay Pacific booking as unverified until you have checked it yourself: open the airline’s official website or app directly — never through a link in the message — and compare the booking reference and flight details there. Do not pay change fees, “verification” charges or refund-processing fees requested by email, text or phone; the airline does not collect them that way. If your booking was in the affected period and you are contacted about it, use the contact channels on the airline’s official site. If travel document information of yours was included, watch for misuse of your name and passport details and report anything suspicious to the airline and your passport issuer.
Sources: Reuters, October 30, 2026 · KLSE Screener (airline statement report), October 30, 2026