Cathay Pacific loyalty program breach exposes customer data
Learn More
Cathay Pacific Airways, Hong Kong's flagship carrier is reporting a data breach affecting its Asia Miles frequent flyer program.
Cybercriminals stole loyalty points and accessed personal information from approximately 1,000 customer accounts. The breach was publicly reported on July 24, 2025, bit the airline reported the incident to Hong Kong's privacy authorities over a week earlier.
Cybercriminals used valid member credentials, some of which had been previously exposed on the internet, to gain unauthorized access to customer accounts. The attackers then exploited a vulnerability in Cathay Pacific's secondary verification process to successfully bypass additional security measures and access Asia Miles balances within the compromised accounts.
Exposed Data Types:
- Personal details of account holders
- Travel details and booking information
- Asia Miles balances and account activity
- Account access credentials and login information
The breach impacted approximately 1,000 Cathay Pacific accounts, the majority belonging to Hong Kong-based members. Personal information of additional 2,216 Hong Kong customers were potentially compromised
For the majority of compromised accounts, Cathay Pacific has already contacted affected members, restored their accounts to secure status, and reinstated any stolen Asia Miles points. Remaining affected customers have had their accounts temporarily locked for security purposes while the airline verifies their identities and implements additional protective measures.
