Cathay Pacific says data from about 53,000 bookings was exposed after attackers got into systems run by Amadeus IT Group, the Spanish travel technology company that handles reservations for the Hong Kong carrier. The airline says most of the exposed records contained passenger names and flight details, and it has no evidence that financial or payment information was taken. The South China Morning Post and The Economic Times both report the 53,000 figure. The unauthorised access ran from August 2023 to September 2026, so the attackers may have had access for about three years. Cathay is a separate victim from Japan Airlines, and the list of airlines hit through Amadeus now includes Japan Airlines, All Nippon Airways, Korean Air, Asiana and now Cathay.
What Happened
Cathay announced the incident on Friday, 30 October 2026. It said the unauthorised access took place inside Amadeus's systems, not its own. According to The Economic Times, Cathay says its own systems and operations were not affected and its services are running normally. Amadeus has told the airline it has taken steps to contain the breach, and Cathay says its own investigation is still going on.
Cathay's disclosure follows a run of similar ones from other airlines in Asia:
- Korean Air and Asiana went first, on 23 October. Korean Air says Amadeus formally notified it on 20 October that personal data appeared to have leaked from Amadeus's systems.
- Japan Airlines said on 29 October that Amadeus had notified it on 23 October. BleepingComputer reports that JAL put the access window at 10 August 2023 to 23 September 2026, with about 92,000 customers affected.
- All Nippon Airways also disclosed on 29 October. It said customer data may have been exposed and that it was still working out how many people were affected.
Cathay's August 2023 to September 2026 window matches the window JAL, Korean Air and Asiana gave. That strongly suggests a single campaign against Amadeus, not separate break-ins at each airline. Amadeus has not published a full list of affected airlines, and BleepingComputer notes the company serves more than 400 airlines. More disclosures are likely.
One older incident needs to be kept apart from this one. Reports that Cathay "flagged a data breach affecting 9.4 million passengers" refer to the airline's 2018 incident, which involved passport numbers, Hong Kong identity card numbers and some credit card data. That breach is not connected to the Amadeus campaign, and the 9.4 million figure does not apply here.
What Was Taken
According to the South China Morning Post and The Economic Times, Cathay says the exposed data includes:
- Booking references (PNR codes)
- Passenger names
- Flight details
The airline says "most" cases involved names and flight details. That wording leaves room for a smaller group whose records held more. Cathay has not said whether any of its passengers had passport numbers, contact details or frequent flyer numbers exposed. This gap matters. JAL's disclosure split its 92,000 victims into about 90,000 with basic itinerary data and about 2,000 whose records also included email addresses, phone numbers, passport numbers, nationalities and frequent flyer numbers. Cathay has not given a similar breakdown.
Cathay says it has no evidence that financial or payment data was accessed. That matches what JAL, Korean Air and Asiana have said, and what Amadeus said in its earlier public statement.
The count is also in bookings, not people. One booking can cover several passengers, so the number of people affected could be higher than 53,000. Cathay has not given a passenger count.
Why It Matters
Cathay's systems were never breached. Its customers' data was exposed anyway, because the reservation records sit with a supplier that serves hundreds of airlines. Every airline that disclosed this month has said the same thing: our network is fine, the vendor's isn't. For defenders, that is the point. Your security only goes as far as your most-connected supplier's.
Three things stand out:
- How long it went unnoticed. About three years of access before anyone detected it means the attackers could quietly gather itinerary data on travellers across several airlines over a long period. Long, low-noise collection like this fits intelligence gathering better than smash-and-grab crime. No one has publicly named who was behind it.
- What the data is useful for. Names combined with booking references and exact flight details are ideal for convincing phishing: fake rebooking notices, "your flight has changed" messages and refund scams. Korean Air has already emailed customers warning them not to click unfamiliar links or open unexpected attachments. A booking reference plus a surname is often enough to log in to "manage my booking" pages, where a passenger's itinerary can be viewed or changed.
- The scope keeps growing. Each new airline adds to the total. JAL had 92,000 and Cathay has 53,000. ANA, Korean Air and Asiana have not published final counts.
The Attack Technique
Neither Cathay nor Amadeus has explained how the attackers got in. What is publicly known comes from the other affected airlines and from separate reporting, and the accounts do not fully line up.
Misuse of a valid Amadeus system account. Korean Air and Asiana, as reported by Korean media and summarised by security firms Safeguard and Rescana, say the attacker logged in with valid credentials for an Amadeus system account. Whether those credentials were stolen, leaked or misused by an insider has not been disclosed. The Korean airlines' August 2023 to September 2026 window is the same one Cathay gave.
A separate exposed memory dump. In mid-October, heise online reported a different problem after readers tipped it off. A Spring Boot application in an Amadeus booking environment had a heap dump endpoint open to the internet with no login required. The memory dump contained access credentials and authentication tokens in plain text, including administrator passwords that heise says gave read and write access to the wider system. heise says it was able to search passenger records by surname and see names, dates of birth, booking codes, contact details and passport data. Many of those records belonged to Lufthansa and Condor passengers. Amadeus confirmed the issue to heise, and the exposure appears to have been closed.
Amadeus's own statement. BleepingComputer reports that Amadeus published a statement on 1 October about a vulnerability in its "travel booking display environment" that could expose traveller data. At the time, Amadeus said no ransomware actors had exploited it and no payment data was exposed. Safeguard dates Amadeus's confirmation to 13 October, when it responded to heise. BleepingComputer says JAL's disclosure suggests the flaw was in fact exploited.
Whether these are one incident or two is not settled. Safeguard's analysis deliberately treats the credential misuse and the heap dump exposure as separate events, since no one has publicly linked them. It is plausible that credentials taken from an exposed memory dump were later used to log in to a system account, but no airline, Amadeus or any regulator has said so. Cathay has not said which mechanism affected its bookings. No CVE, indicators of compromise or attribution have been published.
What Organizations Should Do
- List every supplier that holds your customers' personal data and find out how they detect misuse. For each one, ask how they would notice a valid account pulling records for years. Put contract terms in place that require them to notify you of incidents quickly and to share the logs and access history you need for your own investigation.
- Hunt for long-lived service and system accounts. Review service accounts for credential age, where they log in from, how much data they pull and the times of day they are used. Rotate credentials that have not changed in years and move to short-lived tokens wherever possible. Credential abuse that lasted from 2023 to 2026 implies nobody was watching that account's behaviour.
- Lock down Java and Spring Boot management endpoints. Check that actuator endpoints such as /heapdump, /env and /configprops are switched off or require authentication, and that they cannot be reached from the internet. Treat any heap dump that has been exposed as a full credential leak and rotate everything in it.
- Tighten the "manage my booking" process. If customers can retrieve bookings with only a surname and booking reference, add rate limiting, bot detection and a second check before allowing changes to contact details or itineraries.
- Warn affected customers about targeted phishing ahead of time. Tell them clearly which channels you will use to contact them, that you will never ask for payment or passport details by email or SMS, and how to check a message about a flight change is genuine.
- Search for your data in criminal markets. Monitor dark web markets and paste sites for your customers' booking records. Korean Air and Asiana say they are already doing this.
Sources: Cathay Pacific says data from 53,000 bookings compromised in Amadeu... | Japan Airlines suffers third-party data breach exposing passenger info | Security vulnerability in flight booking system heise online | Cathay Pacific reports personal data security incident involving Am... | Cathay Pacific flags data breach affecting 9.4 million passengers | Amadeus Cyberattack: What Four Asian Airlines Reported | Amadeus Data Exposures: Korean Air, Asiana, Lufthansa and Condor S... | Korean Air and Asiana Airlines Data Breach via Amadeus: Cybersecuri...