Cathay Pacific says breach at provider Amadeus affected about 53,000 bookings

Cathay Pacific Airways said a data security breach at its technology service provider, Amadeus IT Group, affected about 53,000 bookings. The South China Morning Post and Reuters both reported the airline's statement.

Cathay Pacific made the disclosure on Friday, according to Reuters. Reuters described Amadeus as a Spanish software provider.

How the incident is described

According to the South China Morning Post, the breach was carried out by hackers who got into the Amadeus system. The newspaper describes the incident as a cyberattack. Reuters calls it a data security breach.

The South China Morning Post also reported that Cathay Pacific is among hundreds of airlines worldwide that use technology from Amadeus. According to the newspaper, Cathay Pacific's disclosure follows similar disclosures by Korean Air and Japan Airlines.

What each side says

Cathay Pacific said most affected cases involved exposed passenger names and flight details, according to the South China Morning Post. The airline said there is no evidence that financial data was accessed, the newspaper reported.

According to Reuters, Cathay Pacific said its own systems and operations were not affected by the breach.

The reports reviewed by Vocemundi do not include any statement from Amadeus IT Group.

What is not known

The reports do not say when the breach happened, when it was detected or when Cathay Pacific was told about it. They do not say how many individual passengers are behind the roughly 53,000 bookings. They do not identify who carried out the breach or how it was done.

The reports do not say how many airlines in total were affected. They give no figures for Korean Air or Japan Airlines. They do not say whether regulators or data protection authorities were notified. They also do not describe what steps Cathay Pacific or Amadeus are taking for affected customers.

Neither report quotes Cathay Pacific's statement directly. For this reason, the exact wording, including whether the figure is 53,000 or about 53,000, cannot be checked against the original. The South China Morning Post and Reuters report separately and both attribute the figures to Cathay Pacific, but neither says whether they are drawing on the same statement.

Analysis

The case shows how a single technology provider can link data exposure across several airlines. If Amadeus serves hundreds of carriers, as the South China Morning Post reports, more disclosures are possible, but the reports reviewed by Vocemundi do not confirm any beyond Korean Air and Japan Airlines. Key open questions are the timing of the breach, the number of passengers involved and whether authorities were notified. A statement from Amadeus could clarify the scope. Until then, the main account comes from Cathay Pacific itself, which says financial data was not shown to be accessed and its own systems were unaffected.

Produced by the Vocemundi newsroom with AI assistance.