Cathay Pacific data breach: are you affected and can you claim compensation?

Hong Kong’s flag carrier Cathay Pacific has become the latest airline to suffer a data breach, with the personal details of 9.4 million customers being compromised.

The company says it found a hacker had gained “unauthorised access” to its passenger data systems. As a result, information including passport details, historical travel information and expired credit cards were seen.

Cathay Pacific detected “suspicious activity” on its computer network back in March, before confirming internally in May that a hack had taken place, The Daily Telegraph reports.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

However, the Financial Times says security experts are concerned that the airline took seven months to inform customers.

Jerry Allen, head of aviation crisis management firm Return on Development, told the newspaper: “If we give our data and credit card details in good faith to make a booking, if there’s a hint that data has been compromised, we deserve to know.”

But when the FT quizzed Cathay Pacific on why it took so long to release details of the hack, the company said it needed to gather information “so that people know the facts and we can support them accordingly”.

The news comes a month after a similar hack on British Airways exposed tens of thousands of customer details from 380,000 transactions.

Who is affected?

Customers who have used either Cathay Pacific or its subsidiary Cathay Dragon may have had their details accessed by the hackers, Alphr reports.

Among the leaked data are 860,000 passport numbers, 245,000 Hong Kong identity numbers, 403 expired credit card numbers and 27 credit cards with no card verification value (CVV), the tech site adds.

Despite the quantity of data accessed, Cathay Pacific’s chief executive, Rupert Hogg, says there is “no evidence” to suggest that the hackers misused any of the leaked personal details.

Meanwhile, a spokesperson for the airline confirmed that it is “in the process of contacting affected passengers” to provide them with details of how to protect themselves going forward.

Can you claim compensation?

Not yet. Cathay Pacific has not mentioned whether customers will be owed compensation, according to The Guardian.

Given that the company has only just announced the hack attempt, it may be some time before it decides whether passengers are entitled to compensation.