If you book trips through Expedia, Hotels.com or Vrbo, the company now says attackers did get into its systems. On Thursday 12 November 2026, Expedia Group confirmed attackers reached its systems through a compromised third-party data platform provider, part of a wider supply chain attack that hit several companies at once.
Expedia has not named the supplier, and it has not said what customer information, if any, was taken. The confirmation came after an extortion group called n0n claimed to have stolen more than a terabyte of Expedia data and threatened to publish it unless the company paid up.
What Expedia Has Confirmed About the Cyberattack
Expedia’s statement was short. The company said it was aware of a supply chain attack that security researchers had flagged, and that it contained the issue as soon as it became aware of it, is investigating with outside security experts, and that its platforms remain safe for travellers and partners.
A supply chain attack is one where the intruders break into a supplier first and then use that supplier’s trusted access to reach its customers. In this case the weak link was a technology provider that handled data for Expedia, which is why the company describes the breach as reaching its systems through a third party.
Three things remain unconfirmed: which vendor was compromised, what type and volume of data was exposed, and how many customers are affected. Before Thursday’s statement, Expedia had declined to comment on n0n’s claims.
What the n0n Extortion Group Claims It Stole
n0n is a data extortion operation that appeared in September 2026 and claimed 204 victims in October alone. It first posted its Expedia claim on 3 November, and leak-site monitors logged the Expedia listing on 9 November with the wording “not paid, exposed”. No ransom amount or deadline appeared on the page.
The group’s claimed haul is enormous. In its leak post, n0n claimed more than one terabyte of Expedia data, mostly customer records, including:
- 830,069,282 rows of loyalty account data across 800 files, with email addresses, member IDs, tier names, booking values and points balances in 21 currencies, covering 35 named loyalty programmes
- More than 58 million rows of traveller profile data
- Details of more than 22 million journeys
- Credit spending details, household identifiers and almost 500,000 guest communication records
- A workforce planning database
The group also says it holds more than 333 million account and credential records linked to email addresses, Vrbo reservation and payment records, and live credentials for Expedia’s big data platform, source code repositories and a production cloud environment.
None of those figures has been independently verified. When n0n first listed Expedia it offered no sample records, screenshots or technical evidence, and leak-site operators can inflate stolen volumes, recycle material from older breaches or name companies whose data they do not hold. On 12 November an archive that looks like an extract of the claimed data appeared on the dark web: 11 folders containing hundreds of thousands of email addresses linked to travel data, including log-in details, hotel stays and loyalty points totals. Several files carry date ranges that suggest some of the data may be historical.
Is the Expedia Breach Linked to the Qubole Attack?
That is the open question. Between 14 and 26 October 2026, an attacker used credentials belonging to Qubole, a cloud data platform and a former Expedia vendor, to get into customers’ cloud environments and download data. Security firms Wiz and Sentra documented the campaign, with help from Mandiant.
The method was simple and effective. Companies that used Qubole had set up roles in their Amazon Web Services accounts that let Qubole’s own account in. The attacker took over two Qubole user accounts and used that trust to assume cross-account roles customers had created for Qubole, then harvested stored passwords and keys and copied out storage buckets, sometimes in full. No AWS vulnerability was involved. Sentra put the number of affected Qubole customers in the dozens.
The detail that matters for Expedia is what happened after customers stopped using Qubole. Sentra found that former Qubole customers never revoked the access they had granted, so the door stayed open long after the business relationship ended. Expedia has not said whether its breach is connected to Qubole, and the researchers have not publicly named Expedia as one of the affected companies.
Threat intelligence firm SOCRadar, which found an exposed server tied to an n0n operator in September, said in a 28 October analysis that “every documented n0n intrusion relied on weak or compromised credentials”. It found no exploit code in the operator’s files.
Which Expedia Customers Could Be Affected?
Expedia Group runs more than 200 travel booking sites, including Expedia, Hotels.com, Vrbo, Travelocity, Hotwire, Orbitz and Wotif. Until the company says what was exposed, there is no way to know whether any particular account is involved.
Some email addresses in the leaked archive have turned up in earlier breaches, while many had never appeared in one before. Even if the full claim proves exaggerated, a list of real email addresses tied to real bookings is useful to scammers, so expect phishing messages that mention the breach, a refund or a loyalty points problem. Good to know if you hold an account with any of these brands:
- Check any security notice by logging in through the official Expedia, Vrbo or Hotels.com website or app, never through a link in an email or text
- Ignore unsolicited messages asking you to reset a password, confirm card details or verify loyalty points
- Use a unique password and switch on multi-factor authentication for travel and loyalty accounts
- Watch for unexpected changes to bookings, points balances or contact details
What Happens Next in the Expedia Investigation?
Expedia says its investigation with outside security experts is continuing, and it has not given a timeline for saying what data, if any, left its systems. As of 9 November, its regulatory filings carried no Form 8-K under Item 1.05, the section US-listed companies use to report a material cybersecurity incident to the Securities and Exchange Commission.
Lawyers are already circling. US firm Ahdoot & Wolfson says it is investigating a possible class action against Expedia Group over the alleged breach.
The breach lands as the big booking platforms compete harder for the whole trip, with Airbnb pushing to book flights, cars and more in one app.
FAQ
Who Owns Qubole?
Qubole, the cloud data platform whose credentials were abused in the October 2026 attack, has been owned by software company Idera since Idera acquired it in October 2020.
Has Expedia Asked Customers to Change Their Passwords?
Expedia’s 12 November statement did not ask customers to take any action and said its platforms remain safe for travellers and partners. Changing a reused password and turning on multi-factor authentication is still a sensible precaution while the investigation continues.
Is n0n a Ransomware Group?
n0n is usually described as a data extortion operation: it claims to steal data and threatens to publish it unless the victim settles. Researchers who examined an exposed n0n server found locker source code among its tools, and its Expedia listing is a threat to publish data.
