9.4 million passengers’ data stolen from CX
 

Cathay is directing questions to an unverified twitter account. What a clown show.

Unfortunately its hardly surprising given the state of CX's IT. I have absolutely no idea why the department heads weren't fired years ago.

i am tired of these muppett companies not being able to protect data

facebook
google
ba
now cx

they should be fined hard (best if they need to compensate each customer)

The department head was fired years ago (I can't remember what the specific shambles was then, but if you dig into the archives here you'll find it discussed); unfortunately the new department head seems not to be any improvement. This surely reflects on the competence of the senior prople making those recruitment decisions.

Is there any info on when the hack happened?

No company can protect our personal data these days. These things are getting way too common. Anyone received notification that their data has been breached?

Again, "Time to win".

They swapped IT head multiple times since then, and they cant trace the source of error. Good job, CX.

Apparently happened back in March.. it's amazing how it took them so long to disclose this.. probably wanted to sweep this under the rug and hope no-one notices!

https://www.scmp.com/news/hong-kong/...ay-pacific-and

Wow, talk about stupidity. They fail to understand that they very information they use to confirm identity when calling the MPC line was just compromised. Now they're playing this off as no big deal since no passwords or credit cards were stolen.

If I had this information, I could easily call the MPC/AM line and answer some of the security questions and start making enquiries on the account or even make some bookings with points. This information that was leaked isn't just an MPC/AM issue but a general identity theft issue since now it's easy to steal other information as well. CX needs to do more than just say "Whoops, sorry guys" considering 9.4M customers were affected.

I would say that credit card data compromise is the least of my concerns since that's easy to remedy and as a card holder I have no liability.

I believe what Cathay is saying is that nobody has had their full profile taken. It's more bits of data taken. Like a few numbers of a passport and half an email address. At any rate, visit infosecurity.cathaypacific.com if concerned. The good thing is that CX, unlike BA, has a coordinated response to the threat. I had to cancel two credit cards with the BA thing.

Are you serious?

Their statement informed you some part of your data was not taken, and no one leak all their information.
That means if you have your might have lost your name, your passport number and your previous itin, your email address but they didn't lose something like your seat preference/meal preference.
That was what they mean they did not lose all your data.

If you have called for reporting lost/fraud at asiamiles, you can verify yourself with 4 of such information.
Guess what the thief can do with it.

I do not doubt Cathay's honesty in what they say, but I doubt their ability to know the situation. They clearly have a substandard IT team given how often simple functionality on their website is down (not to mention the ink cartridges in their lounge printers). They either didn't spot this for months or sat on it for months, neither of which inspires confidence. I see no grounds for Cathay to have well-placed confidence that their assessment of the data theft is full and complete.

This is a really worrying trend, and 7 months for notification is totally unacceptable. Perhaps a lot of people affected were EU citizens and EU could slap CX with a good fine? :p

Now I'm thinking if my situation is related, where AM has done a grande f**k-up recently.

Called in the other day to book awards, agent started verification. When asked about passport issuing country (been asked and have answered this many times before) she told me my answer was wrong! She claimed that my passport nationality should be HK. Never even had a HK passport! And the last time I booked awards (1month back) my answer to the issuing country (the real one) was good to go. Wondering what the hell is going on with their customer data mgmt...