October 30, 2026 — Cathay Pacific says about 53,000 of its bookings were accessed in a data breach at Amadeus, the company that runs its reservations system. The same breach has also hit Japan Airlines, ANA, Korean Air and Condor.
What happened
In a notice dated October 30, 2026, Cathay said Amadeus told it about the breach on October 28 and sent more details on October 29. Someone used login credentials belonging to an Amadeus system account to get into Cathay booking records held in Amadeus’ system between August 2023 and September 2026.
- Most records contained the booking reference, passenger name and flight details.
- A smaller number may also have included an email address, a phone number, a travel document number and/or a frequent-flyer number.
- Cathay says there is “no evidence that financial or payment information was accessed.”
- Cathay’s own systems were not affected. Amadeus has reset passwords and stepped up monitoring and says it has seen no misuse of the data so far.
- Cathay has informed the relevant authorities and will contact affected customers individually once it has the details. It is still analysing the data.
- The figure counts bookings, not people. Cathay has not said how many travellers are affected (TBA).
Other airlines hit
| Airline | Reported exposure |
|---|---|
| Cathay Pacific (CX) | About 53,000 bookings |
| Japan Airlines (JL) / Japan Transocean Air (NU) | About 92,000 customers |
| ANA (NH) | Up to 37,800 passengers |
| Korean Air (KE) | Confirmed affected; number TBA |
| Condor (DE) | Confirmed affected; number TBA |
Middle East flights still cancelled
Cathay’s Dubai and Riyadh passenger flights remain cancelled through January 31, 2027. Time Out Dubai reported on October 29 that flexible ticket conditions let affected travellers rebook, reroute or get a refund.
What it means for non-revs
- Watch for phishing. If you had any Cathay booking between August 2023 and September 2026, paid or staff, your name and trip details may be in the exposed data. Be wary of emails, texts or calls that quote a booking reference and ask for payment or login details. Cathay says it will contact affected customers individually.
- Check your frequent-flyer account. Frequent-flyer numbers were exposed in some cases. Review your Cathay, JAL, ANA or Korean Air account for unfamiliar activity, and change your password if you reuse it elsewhere.
- Flights are not affected. Cathay’s operations and booking systems are running normally.
- No Cathay to Dubai or Riyadh until February. Plan any Middle East trips with that in mind.
Sources
- Cathay Pacific — “Personal data security incident involving a third-party service provider (30 October 2026)” — cathaypacific.com
- eSecurity Planet — “Cathay Pacific Says Amadeus Breach Exposed Data From 53,000 Bookings” — esecurityplanet.com
- Demócrata — “Leak at Amadeus exposes reservation data from several Asian airlines” — democrata.es
- Time Out Dubai — “These 16 airlines have suspended flights to Dubai” — timeoutdubai.com
Get NonRev Travel News by email
A weekly recap newsletter, sent out every Sunday, with the airline, airport, cruise and travel-warning news that matters to airline employees and retirees. Free.
Subscribe free
