Breachesby GlyphCathay Pacific
Disclosed Oct 24, 20189,400,000 affectedSettled
Breach exposed 9.4M passengers' data; ICO fine of GBP 500,000
Attackers entered Cathay Pacific systems via an internet-facing server as early as October 2014 and installed malware to harvest data, exposing names, passport and ID details, birth dates, contact details and travel history of about 9.4 million customers, 111,578 of them in the UK. The ICO imposed the maximum GBP 500,000 fine.
What is known
| People affected | 9,400,000 (as reported by the organization) |
|---|---|
| Disclosed | Oct 24, 2018 |
| Discovered | Mar 2018 |
| Attack | Hacking |
| Data exposed | NamesGovernment IDsDates of birthPhone numbersEmailsAddressesPayment cardsOther |
| Sector | Transport · HK |
| Status | Settled |
| Lawsuit or fine | GBP 500,000 ICO fine (March 2020) (about $640K) |
Sources
Notices filed
History of this record
confirmed to settledby seedSource
empty to 640000by seedSource
empty to GBP 500,000 ICO fine (March 2020)by seedSource
["names","government-id","dob","phone","emails","addresses","payment-card"] to ["names","government-id","dob","phone","emails","addresses","payment-card","other"]by seedSource
empty to 2018-03by seedSource
Hong Kong's Privacy Commissioner found that Cathay Pacific and Dragonair failed to protect personal data of about 9.4 million passengers accessed without authorization, citing weak vulnerability management and data governance. to Attackers entered Cathay Pacific systems via an internet-facing server as early as October 2014 and installed malware to harvest data, exposing names, passport and ID details, birth dates, contact details and travel history of about 9.4 milby seedSource
Unauthorized access to data of about 9.4 million Cathay passengers to Breach exposed 9.4M passengers' data; ICO fine of GBP 500,000by seedSource
First recordedby seedSource
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.