A UK law firm called SPG Law has launched a group action against Cathay Pacific Airways after the airline announced that data of about 9.4 million passengers of Cathay and its unit, Hong Kong Dragon Airlines, had been breached.