Technology1 min read

Cathay Pacific says Amadeus breach affected 53,000 bookings

By · Published by Everything Blog

In short

The October 28 breach targeted Spanish software provider Amadeus, exposing flight information and passenger names from reservations created between August 2023 and September. Cathay Pacific noted that a smaller subset of affected files contained additional personal information, but confirmed no financial details were compromised. Amadeus has since implemented containment measures and heightened system monitoring as industry investigations into the travel booking display vulnerability continue.

Key points

  • Cathay Pacific maintained that its proprietary internal systems and flight operations avo…: Cathay Pacific maintained that its proprietary internal systems and flight operations avoided any direct technical impact.
  • Third-party software vendor Amadeus contained the system vulnerability and found no evide…: Third-party software vendor Amadeus contained the system vulnerability and found no evidence of ransomware deployment.
  • Multiple Asian carriers including Asiana Airlines suffered passenger data compromises ori…: Multiple Asian carriers including Asiana Airlines suffered passenger data compromises originating from the same vendor platform.

Sources checked by our analysis pipeline: 1

Oct 30 : Hong Kong flagship carrier Cathay Pacific Airways said on Friday a data security breach at the Spanish software provider Amadeus affected around 53,000 bookings, though its own systems and operations were unaffected.

Cathay joins other airlines, including Japan Airlines and South Korea's Asiana Airlines, that recently flagged customer data was compromised in the Amadeus breach.

• The October 28 breach included booking reference, passenger name and flight details in most cases, but additional personal information was compromised in a smaller subset of cases, Cathay Pacific said

• Cathay Pacific said the breach affected bookings from August 2023 to September, citing Amadeus data, and added there was "no evidence that financial or payment information was accessed"

• It said Amadeus has taken actions to contain the incident and implemented enhanced monitoring and detection capabilities on its systems

• Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, but did not respond to a question on how many airlines and customers' data were affected

• The investigations are ongoing and there are no…

Technology