They Got In Through the Vendor. Expedia Just Confirmed It.

Expedia Group confirmed on Thursday that attackers reached its systems through a compromised third-party data platform provider, in a supply-chain break-in the company says also hit other businesses. The confirmation ends days of silence after an extortion group claimed hundreds of millions of Expedia records. What Expedia has not said matters just as much: how much data was taken, what kind, or which vendor let the attackers in.

The claim: nearly a billion records

The group calling itself n0n, a newly established extortion outfit, claims its haul includes more than 830 million loyalty program records, 58 million traveler profiles, and over 333 million consumer account records. The alleged files also include 438.5 million lines of consumer bureau enrichment data, 221 GB of booking event files with nearly 23 million trip records, 2.4 million card spending records keyed to hashed emails, and 500,000 guest communication records.

The group also claims it stole live credentials for Expedia’s big data platform, reaching source code in 19,935 private repositories and production cloud environments — and has threatened to publish unless Expedia reaches a settlement. The claim surfaced in early November, after n0n listed Expedia on its leak site.

None of those numbers has been independently confirmed — they are the extortion group’s claims, and Expedia has not verified them. That gap, between what attackers claim and what a company confirms, is where most of the damage and the panic live.

What Expedia actually confirmed

In a statement to Skift on Thursday, Expedia Group said it was aware of a supply chain attack in which attackers compromised a third-party data platform provider and used its trusted access to reach systems belonging to multiple companies, including Expedia Group.

Expedia said it contained the issue, brought in outside cybersecurity experts, and that its platforms remain safe for travelers and partners to use. The company has not disclosed the extent of any exposure, has not named the vendor, and has not publicly attributed the attack to n0n. The group says it stole the data; Expedia has separately confirmed that unauthorized access took place through a compromised provider. Those are two different statements; only the second is confirmed.

Why booking data is phishing gold

Even if only a fraction of the claimed haul is real, contact details plus booking history are exactly what scammers need to write messages that look legitimate. An email that names your hotel, your check-in date, and the amount you paid does not read like spam. It reads like the booking you made.

Booking.com disclosed a data breach in April 2026 involving customer booking data, and customers then reported phishing emails, calls, and WhatsApp messages referencing their bookings. At least 14 campers were scammed. The Expedia claim, if true, would hand attackers the same raw material at far larger scale — across Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire, and Trivago.

Nothing published so far confirms payment-card data was exposed, so no need to cancel cards on this report alone. But loyalty points, credentials, and trip details are valuable on their own — exactly the data that fuels targeted scams for months after a breach.

The vendor door keeps opening

The Expedia incident follows a pattern this blog has covered repeatedly: the attacker never touches the target’s front door — they compromise a trusted supplier and ride its access inside. Researchers at Wiz and Sentra documented intrusions between October 14 and 26 in which attackers used access tied to Qubole, a cloud data platform, to enter customers’ clouds — former customers had never revoked the access they granted, leaving a way in after the relationship ended. Expedia has not confirmed any link to those intrusions, and the researchers have not named Expedia among the affected companies — the Qubole connection remains unproven context, not fact. The mechanism, though, is the same one we covered when one vendor key opened every customer’s cloud: trusted third-party access, left standing, becomes the attacker’s front door.

It is the same lesson as the Baker Tilly breach, where a vendor’s platform exposed clients who never dealt with the attacker at all: the company you trust with your data is only as safe as the least-guarded supplier it trusts with the same data.

What travelers should do now

If you have an Expedia, Hotels.com, or Vrbo account, four checks are worth doing today:

• Change your password, and make it unique. If you reused it anywhere else, change those accounts too, and turn on two-factor authentication.
• Treat booking-themed messages with suspicion. Any email, text, or call referencing a real trip, hotel, or booking amount could be built from stolen data. Don’t click its links — open the Expedia app or site directly.
• Review your bookings and loyalty balance for trips, changes, or points redemptions you did not make, and report anything unfamiliar to Expedia support.
• Prefer app-based two-factor authentication — authenticator apps or passkeys beat SMS codes, which are only as safe as the chain of providers that deliver them.

Expedia says its investigation is continuing. Until the company says what was taken, the honest summary is the headline: the break-in is confirmed, the billion-record claim is not. Assume any message that knows your itinerary could have been written by someone who should not know it.