HONG KONG (AFP, REUTERS) - Hong Kong carrier Cathay Pacific came under pressure on Thursday (Oct 25) to explain why it had taken five months to admit it had been hacked and the data of about 9.4 million passengers of Cathay and its unit, Hong Kong Dragon Airlines, had been accessed without authorisation.

The airline said on Wednesday that it had discovered suspicious activity on its network in March, and confirmed unauthorised access to certain personal data in early May.

However, chief customer and commercial officer Paul Loo said officials wanted to have an accurate grasp on the situation before making an announcement and did not wish to "create unnecessary panic".

News of the leak sent shares in Cathay, which was already under pressure as it struggles for customers, plunging more than 6 per cent to a nine-year low in Hong Kong trading. Local politicians have also slammed the carrier, saying its response had only fuelled worries.

"Whether the panic is necessary or not is not for them to decide; it is for the victim to decide. This is not a good explanation at all to justify the delay," said IT sector lawmaker Charles Mok.

Legislator Elizabeth Quat said the delay was "unacceptable", as it meant customers missed five months of opportunities to take steps to safeguard their personal data.

The airline admitted that about 860,000 passport numbers, 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed.

Other compromised passenger data included nationalities, dates of birth, phone numbers, e-mail addresses and physical addresses.

"We have no evidence that any personal data has been misused. No one's travel or loyalty profile was accessed in full, and no passwords were compromised," chief executive Rupert Hogg said in a statement on Wednesday.

Probe launched

But Mr Mok said the public needs to know how the company can prove that was the case. "Such a statement doesn't give people absolute confidence that we are completely safe, and it doesn't mean that some of this data would not be misused later," he told AFP.

He pointed out that the European Union's new General Data Protection Regulation says any such breach should be reported within 72 hours.

Hong Kong's privacy commissioner Stephen Wong expressed "serious concern" over the breach in a statement on Thursday and said the office would initiate a compliance check with the airline.

"Organisations in general that amass and derive benefits from personal data should ditch the mindset of conducting their operations to meet the minimum regulatory requirements only," Mr Wong said. "They should instead be held to a higher ethical standard that meets the stakeholders' expectations alongside the requirements of laws and regulations," he added.

Cathay said it had launched an investigation and alerted the police, and that there was no evidence that any personal information had been misused. The company is in the process of contacting affected passengers and providing them with solutions to protect themselves.

The troubled airline is already battling to stem major losses as it comes under pressure from lower-cost Chinese carriers and Middle East rivals. It booked its first back-to-back annual loss in its seven-decade history in March, and had pledged to cut 600 staff, including a quarter of its management, as part of its biggest overhaul in years.

In August, Cathay Pacific posted a narrower half-year loss on a strong rise in airfares and cargo rates, and flagged expectations for a better second half despite economic headwinds from mounting United States-China trade tensions.

The hack also comes more than a month after British Airways apologised over the theft of credit card details of hundreds of thousands of its customers over a two-week period in an attack on its website and app.