Following JAL Group’s disclosure covering about 92,000 customers, Cathay Pacific says it is investigating and will notify affected customers once details are established.
Cathay Pacific said on October 30, 2026 that a breach at Amadeus, a Spain-based travel software provider, affected approximately 53,000 bookings. Its own systems and operations had not been affected and remained unaffected.
The announcement follows JAL Group’s October 28, 2026 disclosure covering customers of Japan Airlines and Japan Transocean Air.
A passenger reservation record contains an itinerary for one passenger or a group travelling together, so one booking need not represent one person.
| Airlines | Approximate affected count |
|---|---|
| Cathay Pacific | 53,000 bookings |
| Japan Airlines and Japan Transocean Air | 92,000 customers |
In a statement covered by The Business Times, Cathay Pacific said booking references, passenger names and flight details were accessed in most affected cases.
A smaller subset involved potential access to additional personal information, including email addresses, phone contacts, travel documents and/or frequent-flyer numbers. The airline said there was no evidence that financial or payment information had been accessed.
Ukraine’s October 24 announcement followed losses of drone control above about 150 km/h. Its Defence Ministry said restored links mattered for frontline drone operations, logistics and communications.
Cathay Pacific said the unauthorized access occurred between August 2023 and September 2026. Amadeus notified the airline on October 28, 2026, then provided further details on October 29 about unauthorized access using login credentials assigned to its system account. Those dates describe the notification and follow-up to the airline.
Cathay Pacific said Amadeus confirmed taking steps to contain the incident, including a password reset and stronger monitoring and detection. It also said Amadeus had not identified evidence that the affected data had been misused.
In comments carried by CNA Business, Amadeus said it had become aware of a vulnerability, or security weakness, affecting an environment used to display travel bookings. The company said investigations were ongoing and there were no indications that the vulnerability had been exploited for ransomware purposes—attacks that demand payment.
The total number of affected airlines and unique passengers remains unknown. Amadeus has not provided those totals. The two counts cannot establish a total of individual people affected.
Cathay Pacific said it continued to investigate and would notify affected customers individually once the relevant details were established.
3 min
An October 28, 2026 advisory puts losses at about $3.5 million and says Ledger is reviewing the affected cases while police investigate.
3 min
CISA orders federal agencies to patch by 1 November under a binding directive, while urging other operators to act. GitLab has released fixes and threat detections for customers running their own servers.
2 min
