Expedia Cyberattack November 2026 Explained: Supply-Chain Breach Confirmed, What Travellers Should Do

on

Expedia cyberattack November 2026 — Expedia Group logo

Image: Expedia Group — Expedia Group logo (official company logo, via Wikimedia Commons)

TL;DR: Expedia Group has confirmed that attackers reached its systems through a compromised third-party data platform provider, in a supply-chain cyberattack that also hit other companies. The company has not said how much customer data, if any, was exposed. A hacking group called n0n claims it stole close to a billion Expedia records — that claim is still unverified. Travellers should change their Expedia password, turn on two-factor authentication, and treat unexpected booking emails with suspicion.

📌 Key Highlights

  • Expedia Group confirmed on 12 November 2026 that attackers reached its systems via a compromised third-party data platform provider.
  • The company calls it a supply-chain attack that also affected multiple other companies — but has not disclosed the extent of any data exposure.
  • Extortion group n0n claims it stole around a billion Expedia records, including loyalty data, traveller profiles and booking records. That claim remains unverified.
  • Expedia Group owns Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire and Trivago, so the incident potentially touches travellers across all of those brands.

What happened?

Expedia Group, one of the world's largest online travel companies, has confirmed a cyberattack on its systems. In a statement to travel-industry publication Skift, published in the early hours of 13 November 2026, the company said it was aware of a supply-chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used that access to reach Expedia's systems.

Until now, Expedia had declined to comment on claims by a newly emerged extortion group, n0n, that it had stolen more than a terabyte of Expedia data and would publish it unless paid. Thursday's statement is the company's first acknowledgement of an attack. It has not named the provider, said when the intrusion took place, or disclosed whether — or how much — customer data was exposed, or which brands were affected.

What the hackers claim — and what is not confirmed

The gap between what n0n claims and what Expedia has confirmed is wide. The group first listed Expedia on its leak site in early November, claiming a haul of roughly 747 GB. According to its own breakdown, reported by Cybernews and other security outlets, the alleged haul includes 830 million loyalty-programme rows, 58 million traveller profiles, 333 million consumer account records with password-like tokens, 221 GB of booking events and 23 million journey records — plus credentials for Expedia's big-data platform, source code and production cloud access.

None of those figures has been confirmed by Expedia or any independent source; when the claims first surfaced, the group provided no sample data. Cyber Daily has since reported an archive purporting to be part of the haul has appeared on the dark web — but that is still the attackers' own material, not a company-confirmed scope. n0n emerged in September 2026 and has listed 300+ alleged victims, including LiveRamp and DraftKings, whose claims also remain unverified.

Expedia cyberattack November 2026 — Expedia building in Bellevue, Washington

Image: Wikimedia Commons — Expedia's former headquarters building in Bellevue, Washington (illustrative)

Why it matters for travellers

Expedia Group's brands handle bookings for hundreds of millions of travellers, and its loyalty programmes hold years of travel history: where people stayed, when they travelled and how to reach them. That is exactly the detail that makes phishing messages convincing — researchers warn scammers could use booking details from this incident to send fake "your booking has changed" emails that look genuine because they quote real trip information. The supply-chain angle matters too: the same compromised vendor may have exposed data at other companies as well.

What travellers should do now

✅ Do this today: change your Expedia password (and the same password anywhere else you reused it), turn on two-factor authentication, and check your loyalty points and recent bookings for anything unfamiliar. Be extra sceptical of emails or texts about bookings, refunds or account changes — go to the Expedia app or website directly instead of clicking links. If you booked through Hotels.com, Vrbo or another Expedia brand, take the same steps there.

There is no need to cancel cards or bookings on what is known today — no payment-card theft has been confirmed — but do watch your statements. If Expedia confirms a wider data exposure, or a regulator steps in, this article will be updated.

FAQs

Has Expedia confirmed a data breach?
Expedia has confirmed a cyberattack reached its systems through a compromised third-party data platform provider. It has not confirmed that customer data was stolen, and has not disclosed the extent of any data exposure. The investigation is ongoing.

How many Expedia customers are affected?
Nobody knows yet. The hacking group n0n claims close to a billion records, but those figures are unverified and the group has a record of inflated claims. Wait for the company's or a regulator's confirmed count.

Which Expedia brands are affected?
Expedia has not said. Expedia Group owns Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire, Trivago, Wotif and CheapTickets. Until the company gives brand-level detail, customers of any Expedia Group brand should take the same precautions.

What should I do if I have an Expedia account?
Change your password, enable two-factor authentication, review your loyalty points and bookings, and be wary of phishing emails that quote real booking details. Do not click links in unexpected booking or refund messages — open the app or type the website address yourself.

Takeaway: Expedia has confirmed attackers got into its systems through a vendor — a real, major-platform incident. But the billion-record figures are still only the hackers' claims. Change your password, switch on two-factor authentication, and watch for phishing; the confirmed facts will be added here as they emerge. Checking your password and two-factor settings today takes two minutes and helps whatever the final confirmed scope turns out to be.

Sources

Comments

Post a Comment