Amadeus Cyber Attack Exposes 53,000 Cathay Pacific Bookings
What Happened — On 2 November 2026 travel‑technology provider Amadeus announced that a cyber‑attack compromised its reservation platform, exposing personal and travel‑itinerary data for approximately 53 000 Cathay Pacific bookings. The breach was discovered after anomalous activity was detected in the booking‑display service, prompting Amadeus to shut down the affected module and begin forensic analysis. Attackers appear to have leveraged a previously unknown flaw in the booking‑display API to extract reservation records, though the exact technique has not been publicly disclosed. Amadeus is notifying affected passengers, working with law‑enforcement, and has engaged external incident‑response firms. The incident is still under investigation, and no ransom demand has been reported.
Why It Matters for Trust & Control Assurance — The event demonstrates how a single vendor’s security gap can cascade to multiple airlines, making continuous third‑party risk monitoring a critical control for audit readiness across frameworks.
Who Is Affected — Airline operators, travel‑booking platforms, and any organization that relies on Amadeus’ reservation services.
Recommended Actions
- Review Amadeus’ latest security attestations (SOC 2, ISO 27001) and request evidence of remediation.
- Update your third‑party risk assessments to include the new vulnerability and any remediation timelines.
- Verify that access‑control logs for vendor‑connected systems are being collected and retained.
- Incorporate the incident into your incident‑response playbooks for vendor‑originated breaches.
Source: Data Breaches Digest – Week 45 2026
Technical Notes
- Attack vector: suspected API flaw in Amadeus’ booking‑display service (specific CVE not disclosed).
- Exposed data: passenger names, flight numbers, travel dates, and contact details.
- No public CVE or patch information available at time of reporting.