Cathay Pacific Airways warmed customers and shareholders of a large data breach earlier this year, compromising personal information of up to 9.4 million customers.
Data accessed by the hack include email and physical addresses, passports and ID card numbers, loyalty program history and previous travel information.
Non-encrypted card information was also stolen including expired credit card numbers.
Cathay discovered suspicious activity on its server back in March and was able to confirm data was accessed in May.
It is thought to be the biggest data breach of an airline ever
"We are very sorry for any concern this data security event may cause our passengers," Chief Executive Officer Rupert Hogg said in a statement.
"We are in the process of contacting affected passengers and providing them with information on steps they can take to protect themselves."
Cathay instructed a cybersecurity firm to investigate and beef up its security systems.
Hong Kong’s privacy commissioner said it will conduct a compliancy audit on the airline, as lawmakers criticised the ‘unacceptable’ delay in notifying the public of the data breach.
The news saw Cathay’s share price plunge.
Hogg said there was no evidence customers’ personal data has been misused or any loyalty benefits compromised.
The airline has launched a dedicated website at infosecurity.cathaypacific.com to explain more to impacted customers.
