Global Airlines (Top 40) · Airline (Asia, legacy) · Regulatory action + Data breach

Cathay Pacific

Cathay is the most thoroughly documented airline breach in this tab, and the timeline is why: attackers had access from roughly October 2014, Cathay detected suspicious activity in March 2018, confirmed the scope in May, and told the public in October 2018 - roughly three and a half years of exposure (access ran to May 11, 2018) followed by about seven months of internal knowledge before disclosure. Around 9.4 million passengers were affected, including passport numbers and identity card numbers, which unlike a credit card cannot be cancelled and reissued in a week. The UK ICO fine was £500,000, the maximum available under the pre-GDPR regime - roughly five pence per affected passenger.

Severity
Evidence tierUnassigned
Claims confirmed
Last verified2026-08-04

Primary source. www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data — Verified - primary source confirmed.

Freshness. Last verified 96 days ago (2026-08-04); stale after 180 days.

Terms

Arbitration

US and European class-action law firms specifically prepared MASS CLAIMS against Cathay Pacific under Article 82 of the GDPR (allowing compensation for 'inconvenience, distress and annoyance'), describing this breach as 'more serious' than the parallel British Airways incident since it exposed a larger volume of passport/ID/payment data; Hong Kong itself lacks a formal CLASS ACTION regime for consumer cases (a 2012 Law Reform Commission recommendation to create one remains unimplemented), meaning affected Hong Kong residents specifically had LESS domestic legal recourse than EU passengers could access via GDPR.

Data sharing

ONE OF THE MOST THOROUGHLY DOCUMENTED AIRLINE BREACHES FOUND IN THIS ENTIRE TRACKER (2018): hackers accessed passport numbers, Hong Kong ID numbers, credit card numbers, names, and travel history for 9.4 MILLION passengers across 260+ jurisdictions — the breach involved MULTIPLE vulnerabilities across FOUR separate systems (customer loyalty, a shared back-end database, a reporting tool, and the Asia Miles redemption database) and had been underway for an extended period before detection. Hong Kong's Privacy Commissioner (PCPD) issued a formal enforcement notice finding SPECIFIC, NAMED FAILURES: (1) a 2017 vulnerability scan failed to catch a critical, WIDELY PUBLICIZED (since 2007!) vulnerability even though Cathay's own scanning tool had been capable of detecting it since 2013; (2) the vulnerability scan itself was conducted only ANNUALLY, too infrequently; (3) an administrator console was accessible from the EXTERNAL internet rather than restricted to internal network access; (4) MULTI-FACTOR AUTHENTICATION was required only for Cathay's own IT support staff, not other remote system access, until finally fixed in July 2018; (5) database backup files used for migrations (2016-2018) were NOT ENCRYPTED; (6) a personal-data INVENTORY was not even STARTED until August 2017 and remained incomplete when the breach was discovered. Cathay delayed public disclosure for months after detecting the breach in March 2018 and confirming it in early May, not revealing it publicly until October 2018.

Fees and billing

Not itemized this pass.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.

Paper trail: none. No published channel.

Evidence

Claim	Kind	Support	Sources
1. Cathay is the most thoroughly documented airline breach in this tab.	characterization	n/a	none recorded
2. Attackers had access from roughly October 2014.	fact	supported	none recorded
3. Cathay detected suspicious activity in March 2018.	fact	unknown	1 (1 confirmed)
4. Cathay confirmed the scope in May 2018.	fact	contradicted	1 (0 confirmed)
5. Cathay told the public in October 2018.	fact	unsupported	1 (0 confirmed)
6. There were four years of exposure.	fact	contradicted	1 (0 confirmed)
7. Cathay had about seven months of internal knowledge before disclosure.	fact	unsupported	1 (0 confirmed)
8. Around 9.4 million passengers were affected.	fact	unknown	1 (1 confirmed)
9. The data included passport numbers and identity card numbers.	fact	unknown	none recorded
10. Unlike a credit card, these cannot be cancelled and reissued in a week.	characterization	n/a	none recorded
11. The UK ICO fined Cathay £500,000.	fact	unknown	1 (1 confirmed)
12. £500,000 was the maximum available under the pre-GDPR regime.	fact	unknown	1 (1 confirmed)
13. The fine works out to roughly five pence per affected passenger.	fact	unknown	1 (0 confirmed)

4 of 13 claims have a confirmed source of their own.

Sources

Source	Claim	Tier	Status	Quote
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 3	Unassigned	confirmed	“Cathay Pacific first became aware of suspicious activity on March 13, 2018” Quote basis: not recorded.
none	Claim 4	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 5	Unassigned	not found	No quote recorded. Quote basis: not recorded.
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 6	Unassigned	corrected	“unauthorized access to Cathay Pacific's systems from at least October 15, 2014, until May 11, 2018” Quote basis: not recorded.
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 7	Unassigned	corrected	“The ICO became aware of the breach when Cathay Pacific self-reported on October 25, 2018.” Quote basis: not recorded.
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 8	Unassigned	confirmed	“Of the approximately 9.4 million customers affected worldwide, 111,578 were from the UK.” Quote basis: not recorded.
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 11	Unassigned	confirmed	“£500,000 for failing to protect the security of its customers' personal data” Quote basis: not recorded.
reporting · 2020-03-05 www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data	Claim 12	Unassigned	confirmed	“The fine was issued under the Data Protection Act 1998 (the "DPA") and represents the maximum fine available.” Quote basis: not recorded.
none	Claim 13	Unassigned	not found	No quote recorded. Quote basis: not recorded.

Source vault

Link status: Candidate - not yet fetched

Document	Last fetch	PDF
Privacy policy cathaypacific.com/cx/en_US/legal/privacy-policy.html	Not fetched yet	NO (HTML only)
Terms of service cathaypacific.com/cx/en_US/legal/conditions-of-carriage.html	Not fetched yet	NO (HTML only)
Website No URL recorded	Not fetched yet	—
Primary source https://www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-international-airline-cathay-pacific-gbp-500000-maximum-available-for-failing-to-secure-customers-personal-data Verification: Verified - primary source confirmed	Not fetched yet	—

Enforcement

No enforcement actions are linked to this row.

State statute

No HQ state on file, so no state statute applies by headquarters.