Cathay Pacific says information from approximately 53,000 flight bookings was exposed through unauthorized access to its travel technology provider, Amadeus IT Group. The airline's own systems were unaffected.
In its October 30, 2026, disclosure, the Hong Kong carrier said an unauthorized party used Amadeus system-account credentials to access reservation data between August 2023 and September 2026. The incident raises questions about credential security, access monitoring, and the extent of unauthorized activity in systems handling passenger information.
According to Cathay Pacific's security notice, Amadeus has found no evidence of misuse. Investigators have not disclosed how the credentials were obtained or when the intrusion was first detected.
Passenger data exposed in Amadeus breach
Amadeus notified Cathay on October 28 and supplied additional details on October 29. The approximately 53,000 affected records represent bookings, not necessarily individual passengers. Cathay has not established how many travelers were affected.
Most records contained names, booking references, and flight details. A smaller subset may also have included email addresses, phone numbers, travel document information, or frequent-flyer numbers. Cathay reported no evidence that payment or financial information was accessed.
These details could support targeted phishing or airline impersonation. A separate Brevo breach that enabled phishing emails to Trezor subscribers illustrates how compromised third-party services can facilitate fraudulent communications. No such misuse has been confirmed in Cathay's case.
Other airlines have reported exposure involving Amadeus. Japan Airlines identified approximately 92,000 affected customers, including Japan Transocean Air passengers, while All Nippon Airways reported about 37,800.
Similar concerns about information held by external providers arose in the Frontline Education breach affecting employee records.
Amadeus has carried out a password reset and enhanced its monitoring and detection capabilities. The disclosure does not establish whether the attacker maintained continuous access during that period.
Security measures and the ongoing investigation
The reported use of system-account credentials makes access management and monitoring priorities for organizations that depend on external providers. Compromised trusted identities have also figured in the Shai-Hulud npm supply chain attack, although its attack method differed.
Security teams can reduce comparable risks by taking these steps:
- Restrict vendor access. Enforce least privilege, network segmentation, and just-in-time permissions where supported.
- Secure service accounts. Use managed identities, short-lived credentials, and centralized secrets management.
- Monitor suspicious activity. Detect unusual authentication, database queries, and large data exports.
- Minimize data exposure. Limit vendors' access to customer records and enforce retention policies.
- Assess supplier controls. Review authentication safeguards, access logs, security assessments, and notification requirements.
- Test incident response plans. Exercise vendor-account compromise, customer data exposure, and coordinated notification procedures.
Cathay is reviewing the affected records and plans to notify customers individually once their details are confirmed. It has also informed relevant authorities.
The investigation must still establish how the credentials were compromised and when the activity was detected. Those findings will help determine the incident's full scope and whether further safeguards are necessary.
Read more: The recent Good Smile Company data breach provides another example of unauthorized access to customer information and the challenges of establishing what data was exposed.