Nearly a billion traveler records at risk as hackers target Expedia

Expedia Group, one of the world's largest travel technology companies, has been targeted by cyber attackers, as millions of records are allegedly at risk.

A newly established hacking group calling itself n0n claims to have stolen hundreds of millions of records containing customer data. The attackers have threatened to publish the data unless Expedia reaches a settlement.

Their alleged haul includes more than 830 million loyalty program records, 58 million traveler profiles, and over 333 million consumer account and credential records.

The group has also claimed to have stolen live credentials for Expedia's big data platform, gaining access to source code that could reach 19,935 private repositories, as well as production cloud access.

Expedia Group, a US-based travel technology giant, operates several major travel brands, such as Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire, and Trivago, generating nearly $5 billion in revenue. Expedia’s travel platforms connect travelers with a wide range of travel services.

What was allegedly stolen from Expedia?

According to n0n, the stolen files contain:

• 830 million rows across 800 files of data tied to loyalty programs, including customer email addresses, loyalty membership identifiers, points balances in 21 currencies, membership tiers, and booking values. The group says the information covers 35 named loyalty programs
• 58.3 million traveler profiles containing email addresses, account dates, and home airports
• 333.3 million consumer account records pairing traveler account IDs and email addresses with password-like tokens.
• 438.5 million lines of consumer bureau enrichment data allegedly incorporated into Expedia's traveler profile database.
• More than 221 GB of booking event files, containing order numbers, itinerary identifiers, and booking values, alongside nearly 23 million trip journey records.
• 2.4 million card network spending records keyed by hashed customer email addresses.
• 72.2 million consumer matching records linked to customer and household identifiers.
• Nearly 500,000 guest communication records containing accommodation details.

Users at risk of social engineering attacks

The combination of contact details and extensive booking information could give scammers material to craft convincing messages targeting individual travelers.

“If what they claim is true, the breach is massive and includes a lot of customer data, internal code repositories, and internal cloud storage,” Cybernews' research team said.

“Threat actors could use stolen details in phishing attacks and scams. Additionally, leaked internal repositories and cloud storage could be used to discover ways to abuse the platform,” researchers added.

Access to private source code repositories and production cloud environments could also create risks for Expedia's internal systems.

If the credentials attackers claim to have stolen grant the access described, they could expose additional information or provide an entry point for future attacks.

Cybernews has reached out to Expedia for a comment. We will update the article once we receive a response.

Booking data is a treasure trove for scammers

Major booking platforms have been on cybercriminals' radar.

In April 2026, Booking.com disclosed a data breach that involved customer booking data. Customers subsequently reported phishing emails, calls, and WhatsApp messages referencing their bookings.

In another incident in July, hackers stole data from nearly 42,000 reservations at approximately 500 campsites, primarily in France, Italy, and Spain.

The stolen information included travelers' names, email addresses, destinations, booking dates, and payment amounts. At least 14 campers were subsequently scammed through phishing attacks.

A major data breach also affected hotels across the Netherlands, Belgium, and Ireland, where stolen reservation information was used to target guests with fraudulent payment requests.