Cathay Pacific Airways Ltd said that data of about 9.4 million passengers of Cathay and its unit Hong Kong Dragon Airlines had been accessed without authorisation.

Cathay said 860,000 passport numbers, about 245,000 Hong Kong identity card numbers, 403 expired credit card numbers and 27 credit card numbers with no card verification value (CVV) were accessed in the breach.

"We are very sorry for any concern this data security event may cause our passengers," Cathay Pacific chief executive Rupert Hogg said in a statement.

"We acted immediately to contain the event, commence a thorough investigation with the assistance of a leading cybersecurity firm, and to further strengthen our IT security measures."

Hogg said no passwords were compromised in the breach and the company was contacting affected passengers to give them information on how to protect themselves.

The company said it initially discovered suspicious activity on its network in March 2018 and investigations in early May confirmed that certain personal data had been accessed.

Cathay Pacific's chief customer and commercial officer, Paul Loo, defended the length of time it took the airline to alert affected passengers.

"We didn't want to create an unnecessary scare. Now we understand very well how each customer has been affected," Loo told broadcaster RTHK, adding that those affected would be notified in the next two days.

Cathay told Reuters it was important to have accurate information so that people know the facts.

"Now that we have conducted a thorough investigation, we are notifying anyone who has potentially been affected," the airline said in an email statement.

It was not immediately clear who was behind the data breach or what the information might be used for.

Cathay said the Hong Kong Police had been notified about the breach and there was no evidence that any personal information had been misused. 

Cathay in a statement said accessed data includes names of passengers, their nationalities, dates of birth, telephone numbers, email and physical addresses, passport numbers, identity card numbers and historical travel information.