Cathay Pacific DIGITAL

Enterprise Technology Stack & Vendor Relationships

Cathay Pacific’s confirmed enterprise software stack includes SAP S/4HANA as its core ERP (selected 2016, live 2017, with references to SAP HANA Cloud Platform/Enterprise Cloud), Mercer Darwin Benefits (formerly Thomsons Online Benefits) for benefits administration (implemented 2015, live 2016, covering approximately 26,000 employees at an HKD 17m budget), Guidewire for a claims module, Informatica PowerCenter for HR/benefits data orchestration, and SITA Connect Go for airport management, with deployment beginning in 2024 across 51 airports and full operation targeted for early Q2 2025 ¹. The same vendor-tracking profile lists additional technology categories - including Cloud Access Security Brokers (2024–25), Data Loss Prevention (2024–25), Identity and Access Management (2021), Secure Web Gateways (2011), Application Performance Management, and IT Service Management - for which the category and approximate deployment date were confirmed but the specific vendor identity was paywalled and unconfirmed ¹. Cathay’s ongoing cloud and digital transformation, underway since 2014 with a target of 100% of business applications in the cloud by 2025, is built with Infosys (Infosys Cobalt) as lead transformation partner and ServiceNow as the IT service management platform, rolled out roughly 2021–2024 ². Alibaba Cloud and Amadeus Altea appear in the same vendor database as “evaluated” rather than confirmed-in-use, as of a mid-2026 dataset snapshot ¹; a targeted search for a reported 30 October 2026 Cathay Pacific disclosure of unauthorised Amadeus-system-account access exposing data from approximately 53,000 flight bookings over August 2023–September 2026 surfaced no public evidence identified of any such disclosure - results returned only coverage of Cathay’s unrelated 2018 breach and a 2019 Amadeus-linked exposure of an Israeli-subsidiary database, and Cathay’s own newsroom listing, checked 30 October 2026, showed no breach-related item (most recent item dated 22 September 2026). A follow-up, differently-worded search re-confirmed this absence, surfacing only an unrelated September 2026 Amadeus iHotelier (hotel booking, not airline) breach disclosure with no Cathay Pacific connection, and an older, undated Amadeus airline-booking-system vulnerability which Amadeus itself stated involved no detected data breach ³. Consequently this premise could not be confirmed or refuted across two separate research passes, and whether Amadeus Altéa PSS/NDC functions as a live Cathay production system (as opposed to “evaluated”) remains unresolved; the vendor database’s “evaluated” characterization stands unchanged ¹.

Cathay’s Engineering Department signed a digital-transformation agreement with Trax (an AAR Corp subsidiary providing aviation MRO software), dated 18 March 2025, covering a web-based eMRO platform, fully managed cloud hosting, and five mobile applications (AeroDox, VisualCheck, Line Control, TaskControl, eContent Control) ⁴. This aviation-maintenance Trax is a distinct company from “Trax Retail,” an Israel-linked computer-vision retail analytics firm, and no public evidence identified connecting Cathay Pacific to Trax Retail. No public evidence identified connecting Cathay Pacific to Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks.

On the long-running IBM outsourcing lead: a directly-fetched Aviation Week article, dated 18 June 1997, confirms that Cathay Pacific signed a ten-year agreement with Sabre and IBM under which the two companies would develop and maintain a set of IT products and become Cathay’s “preferred IT suppliers,” as part of a “Smartsourcing project” aimed at reducing the number of vendors Cathay had to manage ⁵. This 1997-dated Sabre/IBM relationship is distinct from a separately referenced, later-era IBM deal reportedly covering transfer of over 80% of Cathay’s application portfolio, for which the source page returned no retrievable content and no date could be confirmed, leaving that lead unresolved ³. A further unverified snippet-level lead (Reuters Events/Breaking Travel News, not independently fetched) suggests Cathay later gave Unisys Australia a multi-year data-centre outsourcing contract to take over running core business applications from IBM; no date is recoverable and its relationship to either the 1997 Sabre/IBM deal or the later ~80%-portfolio deal is unresolved ⁶. None of these three IBM-era relationships (1997 Sabre/IBM, the later undated IBM deal, or the subsequent Unisys shift) carries any stated Israeli nexus.

On the previously paywalled CASB/SWG/network-security categories, Cathay Pacific announced in December 2023 its selection of Aryaka’s “Unified SASE as a Service” (converged SD-WAN, SASE and ZTNA) to replace its legacy MPLS/network stack, with deployment reported - at vendor-snippet level only, as the Aryaka case-study PDF returned an unreadable binary stream - as running February 2024 to May 2025, replacing a Cisco Viptela SD-WAN and Symantec Web Security Service proxy, and listing an Aryaka CASB module as a planned future extension ^{7, 8, 9}. Two independent retrieval attempts at the ComputerWeekly account of the same deployment - a direct fetch (HTTP 403) and an attempted web.archive.org snapshot (fetch blocked outright) - both failed again on re-attempt; this avenue is now considered exhausted, and the Aryaka narrative remains unverified from independent (non-vendor) reporting ⁸. Separately, Illumio’s own customer page (fetched directly) documents Cathay Pacific’s use of Illumio Segmentation and Illumio SecureConnect: segmentation protects roughly 600 in-scope applications against lateral movement, SecureConnect provides workload-to-workload encryption across more than 1,000 workstations, an application-dependency map spans on-premises servers plus AWS and Azure cloud environments, the deployment supports PCI DSS compliance (cardholder-data segmentation), and an estimated ~$5 million in avoided data-centre-firewall costs is claimed; the page names Cathay’s Head of Infrastructure Engineering, YC Chan ¹⁰. The naming discrepancy flagged in the existing audit is now substantially resolved by a dated three-snapshot sequence: a directly-fetched Illumio-published blog post dated 22 December 2020 states Cathay implemented “Illumio Core and Illumio Edge” for Zero Trust micro-segmentation, with full implementation completed in under three months per an unnamed Cathay source quoted as “Kerry Peirse” ¹¹; a 29 November 2021 trade-press article corroborates continued use of the “Illumio Core” name ¹²; and the current vendor customer page instead uses “Illumio Segmentation” and “Illumio SecureConnect” ¹⁰. This progression (Illumio Core + Edge, Dec 2020 → Illumio Core, Nov 2021 → Illumio Segmentation + SecureConnect, current) is consistent with a vendor-side product-line rebrand/consolidation over time rather than three unrelated deployments, though no independent or explicit vendor rebrand statement confirms this inference. Neither Aryaka nor Illumio is Israeli-headquartered per their own branding, consistent with the existing audit’s non-finding for named Israeli-linked cybersecurity vendors.

Surveillance, Biometrics & Retail Technology

Cathay Pacific participated in a biometric boarding trial at Amsterdam Schiphol Airport beginning in February 2019, using the Vision-Box (Lisbon, Portugal) “Seamless Flow” platform in partnership with the Dutch Government, Schiphol Group, and KLM ^{13, 14}. Vision-Box is Portuguese, not Israeli-origin, and passengers opted in at check-in, with facial capture at a registration kiosk re-verified at a biometric eGate; Schiphol stated biometric data was deleted 24 hours after capture ^{13, 14}.

On Hong Kong International Airport’s “Flight Token” facial-recognition programme (launched 2021, reported at over 93 million passenger uses, available via Smart Check-in Kiosks to participating airlines’ passengers), IATA’s own 28 October 2026 press release confirms that HKIA (operated by Airport Authority Hong Kong) and Air New Zealand became the first two organisations worldwide to achieve IATA One ID certification, announced at the IATA World Passenger Symposium in Macao, across all four applicable categories (Digitalization of Admissibility, Contactless Travel, Biometric Handling, Privacy/Consent/Governance) ¹⁵. The certification was held by HKIA/Airport Authority Hong Kong, not by Cathay Pacific, and the primary IATA release does not name Cathay Pacific as a certified party or participating airline ¹⁵. Airport Authority Hong Kong CEO Vivian Cheung is quoted in the release stating that Flight Token is being extended beyond Hong Kong in collaboration with airlines, airports, and authorities ¹⁵. A lower-confidence, unverified search-snippet lead (not independently fetched) referenced a 2024 proof-of-concept involving Cathay Pacific, HKIA, and Narita International Airport testing Flight Token interoperability across borders, consistent with - but not confirming beyond - a participant/demonstration role for Cathay in the programme ¹⁶. No public evidence identified of Cathay Pacific holding, operating, or co-certifying any IATA One ID or Flight Token system in its own right.

No public evidence identified of Cathay Pacific use of Trigo, BriefCam, AnyVision/Oosto, or Trax Retail computer-vision retail analytics technologies. No public evidence identified of Cathay Pacific use of Israeli-origin predictive policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified of Cathay Pacific operating, leasing, or co-locating data centre infrastructure in Israel. No public evidence identified of Cathay Pacific participation in Project Nimbus or any comparable Israeli state-backed cloud programme. Cathay’s own cloud transformation - Infosys-led, ServiceNow-based, targeting 100% cloud migration and a smaller physical data centre footprint by end of 2025 - is documented as a general enterprise IT modernization initiative with no stated Israeli nexus ². Illumio’s documented application-dependency mapping spans Cathay’s on-premises servers plus AWS and Azure cloud environments, confirming multi-cloud usage (AWS, Azure) alongside the previously identified “evaluated” Alibaba Cloud entry, though no Israeli-linked cloud provider or sovereign-cloud programme was identified in any source ^{1, 10}.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any Cathay Pacific defence, intelligence, or security-sector contract, programme, or technology-provision relationship, including with Israeli state bodies, defence ministries, or intelligence-linked firms; targeted searches run for this category surfaced no named leads, programmes, codenames, or intermediaries pointing toward such a relationship. Updated searches pairing named Cathay principals and controlling-shareholder figures (Merlin Swire/B N Swire, J S Swire, S C Swire, M V Allfrey) with Israel/Palestine terms likewise returned no relevant results, only generic business-biography pages ^{17, 18}.

AI, Algorithmic & Autonomous Systems

Cathay Pacific and Google announced an AI-powered contrail-avoidance research partnership on 7 September 2026 ¹⁹. A first operational trial phase, begun in late 2025, targeted more than 100 Cathay flights network-wide, of which over 80 were flown on contrail-avoidance routings; Google estimates an approximately 40% reduction in contrail warming impact on those routes, with the Hong Kong–Singapore corridor accounting for over 50% of the trial’s total climate impact ¹⁹. A second phase is planned to extend across Cathay’s Asia and transpacific network and to generate a broader operational dataset, adding Contrails.org - a nonprofit focused on contrail-mitigation science - as a partner ¹⁹. The system combines predictive AI models, satellite-imagery contrail-detection tools, and weather intelligence to forecast contrail-forming zones; forecasts are delivered to dispatchers and pilots for altitude adjustments (analogous to turbulence avoidance) and are displayed through Cathay’s in-house Electronic Flight Folder (EFF) system with in-flight Wi-Fi connectivity ¹⁹. Named participants include Lawrence Fong (Director Digital and IT, Cathay Pacific), Michael Yue (Managing Director and General Manager, Google Hong Kong), and Captain Tony Pringle (Cathay Line Operations Manager) ¹⁹. No Israeli nexus was identified in this partnership; it is a Google (US) collaboration with no stated Israeli-origin component ¹⁹. Aside from this contrail-avoidance system, no public evidence identified of Cathay Pacific’s provision of artificial intelligence, algorithmic, or autonomous-systems technology to Israeli state bodies or defence-linked entities, nor of any Israeli-origin AI vendor embedded in Cathay’s confirmed stack; the company’s other publicly documented technology deployments (SAP, Guidewire, Informatica, SITA Connect Go, ServiceNow, Infosys Cobalt, Aryaka, Illumio) are general enterprise, network-security, and airport-operations systems with no stated AI/autonomous-systems or Israel nexus ^{1, 2, 7, 10}.

Technology Ecosystem & R&D Footprint

No public evidence identified of Cathay Pacific operating or funding an Israeli R&D centre, acquiring an Israeli technology firm, or holding patent, licensing, or research-collaboration arrangements with Israeli institutions; four targeted searches run in this category surfaced no relevant leads. Cathay’s documented technology-ecosystem footprint centers on its Infosys-led cloud transformation partnership ², its 1997 Sabre/IBM Smartsourcing agreement and subsequent IBM/Unisys outsourcing history ^{5, 3, 6}, its Trax (AAR Corp) aviation-maintenance software partnership announced 18 March 2025 ⁴, its Aryaka SASE/network-security engagement beginning December 2023 ⁷, its Illumio microsegmentation deployment, tracked continuously from December 2020 to the present ^{10, 11}, and its Google contrail-avoidance climate-research partnership announced 7 September 2026 ¹⁹; none of these involves an identified Israeli R&D footprint.

Civil Society Scrutiny & Regulatory History

Cathay Pacific disclosed via a Hong Kong Stock Exchange “Inside Information” filing dated 24 October 2018 that it had discovered suspicious network activity in March 2018 and engaged an unnamed “leading cybersecurity firm,” though the filing’s body text could not be extracted from the available source and the vendor’s identity remains unconfirmed ²⁰. The UK Information Commissioner’s Office fined Cathay Pacific £500,000, announced around March 2020, for inadequate security controls between October 2014 and May 2018, a breach that affected approximately 9.4 million passengers, including 860,000 passport numbers and roughly 245,000 Hong Kong ID numbers, with the attacker gaining access via compromised credentials through a remote VPN connection and an administrative console ^{21, 22, 23}. No forensic-vendor name or Israeli-origin cybersecurity product was identified in any retrievable source, and the ICO’s own primary enforcement-decision page could not be independently fetched, so these findings rest on secondary legal and trade-press coverage ^{21, 22, 23}. A separate examiner-directed search for a reported 30 October 2026 disclosure of unauthorised Amadeus-system-account access exposing roughly 53,000 flight bookings over August 2023–September 2026 returned no public evidence identified confirming this incident across two independent search passes; no exposed-data categories or notified regulators could be identified, and this premise remains unverified rather than established as fact³.

Hong Kong–Tel Aviv flight suspension (2023 Israel-Hamas war). This occurred as a two-stage, multi-date sequence rather than a single action. The earliest confirmed disruption was narrower: The Standard (HK), published 9 October 2023, reports Cathay Pacific announced that Monday that it was cancelling flights CX675 (Hong Kong→Tel Aviv) and CX676 (Tel Aviv→Hong Kong) specifically scheduled for Tuesday, 10 October 2023, four days after the 7 October Hamas attack, with Cathay stating it would provide a further update before its next scheduled service on Thursday, 12 October ²⁴. Caixin Global, published 11 October 2023, independently corroborates that Cathay cancelled Tel Aviv flights scheduled for “Tuesday and Thursday,” consistent with the CX675/676 rotation ²⁵. Cathay Pacific then announced, on 22 October 2023, a comprehensive suspension of all Hong Kong–Tel Aviv flights from that date through 31 December 2023 inclusive, citing the Israel–Hamas war and offering rebooking and refunds without the usual fees; this is the action already documented in the existing audit and is confirmed, not corrected, by the newer sources ^{26, 27, 28}. Air Cargo Week, published 5 December 2023, reports a further extension: Cathay announced the cancellation of all Hong Kong–Tel Aviv flights from 5 December 2023 through 28 March 2024 inclusive, again citing “uncertainty related to the ongoing situation in Israel” ²⁹. No source in the existing audit or the updated research identifies a resumption, continued suspension, or permanent discontinuation of the route after the confirmed 28 March 2024 end-date; the current (2026) status of Cathay’s Tel Aviv service therefore remains an open, unresolved gap rather than a confirmed fact. All retrieved reporting characterizes these suspensions as an operational/safety response to the conflict, and no evidence found that they reflect any stated boycott, divestment, or broader political position by Cathay Pacific.

Corporate ownership and governance - shareholding sequence through 2026. Qatar Airways, a roughly 9.6–9.7% Cathay Pacific shareholder since 2017, agreed around 5 November 2025 to sell its entire stake back to Cathay for approximately HK$6.97 billion (≈US$896–897 million), at a reported price of HK$10.8374/share, pending independent-shareholder approval ^{17, 18, 30, 31}. The buy-back completed on 24 February 2026; a primary HKEX completion filing dated that day was fetched but returned only an unreadable binary PDF stream, so the completion figures rest on an aggregator (iTiger) rendering of the filing, corroborated at search-snippet level by Reuters reporting giving matching figures and the precise mechanic - the transaction eliminated Qatar Airways’ entire 643,076,181-share stake ^{32, 33}. Immediately upon completion on 24 February 2026, Swire Pacific’s shareholding rose to approximately 47.64% and Air China’s to approximately 29.97%, per this sourcing ^{32, 33}; the public-float percentage at that specific moment was not stated in the fetched source and is only an unconfirmed arithmetic inference (~22.4%), not a sourced fact. This 47.64% figure both confirms and clarifies - rather than contradicts - the existing audit’s current (post-2026) Swire Pacific figure of 39.15%: the two percentages describe different dates in a subsequent multi-step sequence. On 13 March 2026, Swire Pacific placed 153.1 million Cathay shares (approximately 2.5% of issued capital) for approximately HK$1.79 billion in net proceeds, described in the source’s own words as returning Swire toward its pre-buyback shareholding level; the resulting intermediate percentage is not stated in the source ³⁴. On 2 September 2026, Swire Pacific sold a further 362.65 million Cathay shares (5.96% of issued capital) via an Accelerated Exchange Trade at HK$13.20/share - a 7.69% discount, not the article’s own headline figure of “77pc,” which is treated as a headline error - combined with a repurchase of its HK$4.70 billion zero-coupon exchangeable bonds due 2027; this transaction explicitly dropped Swire’s stake to 39.15%, matching the existing audit’s “current shareholder breakdown” figure ³⁵. Two further snippet-level, unfetched sources give differing discount/proceeds figures for Swire Cathay-share disposals (a 9.6% discount per an unfetched itiger/CLSA commentary snippet, and “a 7% discount, raising $613 million” per an unfetched thebambooworks.com snippet); whether these describe the same 2 September 2026 transaction reported inconsistently, or a separate additional disposal, is unresolved. Cathay’s current shareholder breakdown - Swire Pacific 39.15%, Air China 29.97%, and public 30.88% (summing to 100%, with no residual Qatar Airways stake) - therefore represents the state after both the March and September 2026 Swire disposals, not the state immediately following the February 2026 buy-back ^{30, 31, 32, 33, 35, 34}. A pre-deal analyst warning that the buyback could reduce Cathay’s public float below HKEX’s 25% minimum listing requirement was flagged in secondary sources but no source found explaining how, or whether, this was resolved.

Guy Bradley became Cathay Pacific’s Chair effective at the 13 May 2026 AGM, with Patrick Healy retiring; non-executive directors Sun Yuquan and Wang Mingyuan retired at the same AGM, and Martin James Murray (former Cathay CFO, currently Finance Director of Swire Pacific) and Qu Guangji (President and Executive Director of Air China) were appointed non-executive directors - findings corroborated across three secondary outlets but not independently confirmed from the primary HKEX filing text, which returned only an unreadable binary PDF stream ^{36, 37, 38, 39, 40}. Cathay Pacific Airways Limited’s Hong Kong company registration is confirmed via a primary UK Companies House overseas-entity record (OE023270) as company number 00015833, registered office 31/F One Pacific Place, 88 Queensway, Hong Kong SAR, with UK overseas-entity registration dated 6 February 2023 ⁴¹; secondary sources (not independently fetched) give an incorporation date of 18 October 1948, a former Hong Kong company number of 0002672 (used until 27 December 2023), and current operation as a public company limited by shares under the Companies Ordinance (Cap. 622) ^{42, 43, 44}. John Swire & Sons Limited (London) is described, consistent with the existing audit’s Swire Pacific/John Swire & Sons framing, as the privately held ultimate parent of the Swire Group, with John Swire & Sons (H.K.) Limited as its Hong Kong subsidiary sitting above the listed Swire Pacific Limited ⁴⁵; one lower-reliability, self-flagged “generated profile” source asserted the opposite ownership direction and is treated as unverified and contradicted.

No public evidence identified of any Israeli political contribution, lobbying activity, settlement-linked commerce, or investment in Israeli surveillance, cyber, or SIGINT firms by Cathay Pacific, Swire Pacific, John Swire & Sons, or any named principal. The Swire Charitable Trust’s FY2022 accounts (£408,000 in grants) and FY2023 accounts (over 200 recipients across its Opportunity, Environment, Heritage, Cost of Living, Discretionary, and Scholarship programmes) list no recipient connected to Israel, Palestine, or Middle East political advocacy ^{46, 47}. The “SWIRE 2765” charitable trust’s FY2023 accounts, naming approximately 370 UK charitable/community recipients, likewise show no recipient connected to Israel, Palestine, the Middle East, or a Jewish organisation ⁴⁸. The John Swire 1989 Charitable Trust’s FY2023 accounts (total donations £3,011,156) record a £30,000 grant to Medical Aid for Palestinians (MAP), a UK-registered humanitarian NGO, shown in the 2022 comparative column - i.e., made during fiscal year 2022 - but reduced to nil in FY2023; the Trust’s FY2024 accounts (total donations £3,196,223) show no grant to MAP at all, indicating the grant was a single-year 2022 gift that did not recur in either of the two subsequent years reviewed ^{49, 50}. No public statement explaining the lapse was located. The same trusts’ filings also recur a grant to “St John of Jerusalem Eye Hospital Group,” a UK-registered ophthalmic-hospital charity affiliated with the Order of St John, which is noted here for transparency but is not an Israel/Palestine political or advocacy body ^{49, 50}. Trustees of these Swire family trusts (J S Swire, B N Swire, S C Swire, M V Allfrey, William Leigh-Pemberton, Dr C Isacke, K Imoto, R Hogg, James Edward Hughes-Hallett) were searched individually by name against Israel/Palestine terms where budget allowed; no results were found beyond generic business-biography pages and one unrelated historical note about a differently-named Swire relative’s 1945–48 military posting in Israel, and several trustees (R Hogg, William Leigh-Pemberton, James Edward Hughes-Hallett, Dr C Isacke, K Imoto) were not individually searched this cycle, remaining an open gap ^{17, 18}. A site-restricted search of whoprofits.org and ohchr.org for “Cathay Pacific,” “Swire Pacific,” and “John Swire” returned zero indexed hits, representing an absence of retrievable evidence rather than a confirmed clean record ^{51, 17}. A general search pairing Air China with Israel-settlement/surveillance/investment terms likewise surfaced no Air China-specific nexus, only unrelated general China–Israel investment and surveillance commentary ^{17, 18}.