News
Breach case · Hong Kong · October 2018
Cathay Pacific Passenger Data Breach
Hong Kong's flagship airline disclosed unauthorised access to personal data of approximately 9.4 million passengers.
Incident
What happened
Cathay Pacific disclosed that attackers had accessed systems containing passenger personal data.
Regulators reviewed the airline's security controls, including patching and access management.
The UK Information Commissioner's Office fined the airline under the Data Protection Act 1998.
Analysis
Lessons learned
Delayed detection significantly increases the scale of a breach.
Servers exposed to the internet must be patched and hardened consistently.
Operations across jurisdictions face scrutiny from several regulators.
Prevention
How penetration testing helps
Regular penetration testing and IT audits provide evidence of patching, access control, and monitoring, expected under Hong Kong's PDPO and similar laws.
Sources
Summary based on publicly available information. DIGITPOL HK was not involved in this incident.