Booking.com Data Breach—Reservation Details, Names, Emails And Phone Numbers Affected

Hack attacks targeting the travel industry and its users are not new. Most often, these will involve phishing campaigns such as the ‘I Paid Twice” attacks that hit hotel booking system last year. While this used a fake Booking.com page to launch a ClickFix credential theft attack, the real Booking.com found itself front and center in this newly confirmed security incident.

At this point, there is very little additional information about the nature of the attack itself. A Booking.com spokesperson said, “We recently noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information,” but, perhaps unsurprisingly, did not reveal anything further. What we do know so far is that the company, upon becoming aware of the incident, “immediately took action to contain the issue,” according to the breach notification email, and updated any booking reservation PIN codes associated with affected users.

The number of affected customers is unknown at this stage, but Keven Knight, CEO of Talion, told me that “given that Booking.com is the largest and most widely used travel agency site in the world, this could turn out to be a sizable attack.” Especially as it might not be over, in terms of how threat actors monetize the situation. Armed with genuine Booking.com contact information, and holiday reservations, Knight warned that “victims are still at risk of phishing, and these communications could be highly tailored given the attackers know about the previous holiday bookings.”

I would recommend that all Booking.com users, not just those who have received a data breach incident notification, be highly alert for any emails, messages or phone calls purporting to come from either the travel agency itself or associated hotels and services that request financial or personal data and under no circumstances should you click any links that are provided. Always go directly to the company’s website in your web browser and use a known address. Check your account in the normal way and contact customer support using known methods on the actual website for more help.