http://www.hkexnews.hk/listedco/list...0181024757.pdf
Cathay Pacific Airways Limited (the “Company”) has discovered unauthorised access to some of its passenger data and that of its wholly owned subsidiary, Hong Kong Dragon Airlines Limited. The Company is aware that the passenger data of approximately 9.4 million people has been accessed. The Company has no evidence that any personal information has been misused. The information systems affected were separate from the Company’s flight operations systems. There is no impact on flight safety. The Company initially discovered suspicious activity on its network in March 2018. Upon discovery, the Company took immediate action to contain the event, to commence a thorough investigation with the assistance of a leading cybersecurity firm, and to further strengthen its information system security measures. Unauthorised access to certain personal data was confirmed in early May 2018. Since that time, analysis of the data has continued in order to identify affected individuals and to determine whether the data at issue could be reconstructed. The types of personal data accessed were the names of passengers, their nationalities, dates of birth, telephone numbers, email, physical addresses, passport numbers, identity card numbers, frequent flyer programme membership numbers, customer service remarks and historical travel information. In addition, 403 expired credit card numbers and 27 credit card numbers with no CVV were accessed. The information accessed varies between passengers. No travel or loyalty profiles were accessed in full. No passwords were compromised. Approximately 860,000 passport numbers and approximately 245,000 Hong Kong identity card numbers were accessed.