A threat actor group claims it stole massive volumes of Expedia Group loyalty, traveler, and booking data, though Expedia Group has not confirmed the incident. If you have an account with Expedia Group or its travel brands, change your password, enable two-factor authentication, and monitor your financial accounts closely.
| Company | Expedia Group, Inc. |
|---|---|
| Industry | Retail |
| Data Types Exposed | Email Addresses, Loyalty Point Balances, Traveler Account Identifiers, Booking and Itinerary Records, Password-Like Credential Tokens, Card Network Spend Data, Phone Numbers and Device Identifiers, Payment Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Expedia Group, Inc. Data Breach?
A threat actor group claims it breached the internal systems of Expedia Group, Inc. and stole an enormous volume of consumer and operational data. The claim appeared on a leak site associated with extortion activity, listing the company among its alleged victims. As of now, Expedia Group has not publicly confirmed this incident.
According to the posted claim, the attackers say they pulled data from multiple internal platforms tied to loyalty programs, traveler profiles, booking records, and cloud infrastructure. The listing describes huge data sets, including hundreds of millions of rows spanning loyalty account tables, traveler profiles, and consumer credential archives. The group also claims to have obtained a source code access token tied to thousands of private repositories, along with live production cloud access.
Because this report comes from a ransomware and extortion tracking source rather than from Expedia Group itself, the timeline of when any intrusion supposedly occurred has not been publicly disclosed. The listing marks the case as unpaid, meaning the attackers say the company did not meet any ransom demand before the data was posted. Independent forensic confirmation from Expedia Group has not yet been reported.
Who was affected?
If the claims behind this listing are accurate, the population affected could be extremely large. The data sets described reference loyalty program members, individual travelers, booking customers, and even internal workforce planning records. This suggests both consumers and, potentially, employees tied to Expedia Group’s operations could be implicated.
The exact number of individuals affected has not been publicly disclosed. However, the sheer scale of the row counts referenced in the claim, reaching into the hundreds of millions across different tables, suggests a broad geographic footprint. Because Expedia Group operates numerous travel and loyalty brands, affected individuals could include customers across the United States and internationally.
It is not yet clear whether minors are among those potentially impacted, since family travel bookings often include dependents. Until Expedia Group issues an official statement, the true scope of who was affected remains unconfirmed.
What Information Was Potentially Exposed?
The leak site claim describes an unusually wide range of data categories spread across many internal systems. Because this is currently an unconfirmed claim, the details below reflect what the threat actor group says it obtained, not confirmed findings from Expedia Group.
- Consumer email addresses and member identifiers
- Loyalty point balances and tier names
- Traveler account IDs and home airport information
- Three-year booking value histories
- Password-like credential tokens paired with account identifiers
- Order numbers and itinerary identifiers
- Trip journey detail records
- Card network spend and propensity data keyed by hashed emails
- Customer and household matching identifiers
- Traveler phone numbers and device identifiers
- Vrbo reservation and payment records
- Guest communication records with stay details
- Loyalty member activity metrics including stored card operations
- Workforce call volume and staffing forecast data
If these claims hold up, the risk to affected individuals could be significant. Email addresses paired with credential-like tokens could allow attackers to attempt account takeovers on Expedia Group platforms or other services where people reuse passwords. Phone numbers and device identifiers could also fuel targeted phishing or SIM-swap style attacks.
Financial exposure is another concern. Stored card operation data and payment records, if genuine, could be used for unauthorized charges or sold to other criminals. In addition, detailed booking histories and home airport information could help scammers craft highly convincing, personalized phishing messages that reference real trips or loyalty balances.
What is the company doing?
Because this incident stems from a claim posted on a ransomware and extortion tracking source, there is no indication yet that Expedia Group has issued a public statement or confirmed the breach. As a result, no specific remediation, investigation, or notification steps have been publicly reported at this time.
If the claims are verified, affected individuals would typically expect Expedia Group to launch a forensic investigation, secure any compromised systems, and notify impacted customers as required by law. Until an official response is published, readers should treat the scope and validity of this incident as unconfirmed rather than settled fact.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Given the range of data referenced in this claim, affected individuals should request free copies of their credit reports from the three major bureaus. Reviewing these reports regularly can help you catch new accounts or inquiries you did not authorize.
Because fraud attempts can surface months after a breach, it helps to check your reports periodically rather than just once. If you notice unfamiliar activity, report it to the credit bureau immediately and consider placing a fraud alert.
Consider a Credit Freeze
If payment card or account credential data was genuinely exposed, a credit freeze can prevent new lines of credit from being opened in your name. This step is free and can be lifted temporarily whenever you need to apply for credit yourself.
A freeze is generally considered stronger protection than a fraud alert because it blocks most new credit inquiries outright. For that reason, it’s worth considering if you booked travel or held loyalty accounts tied to Expedia Group brands.
Watch for Phishing and Account Takeover Attempts
Because email addresses and credential-like tokens were allegedly included in the stolen data, affected individuals should be cautious of unexpected emails referencing bookings, loyalty points, or account changes. Attackers often use real details to make phishing messages look legitimate.
As a precaution, change your password on any Expedia Group related account and avoid reusing it elsewhere. Enabling two-factor authentication, where available, adds another layer of protection against unauthorized logins.
Review Loyalty and Booking Accounts Closely
Since loyalty point balances and stored card operations were referenced in the claim, check your loyalty accounts for unusual redemptions or balance changes. Report anything suspicious to the program directly.
In addition, review recent bookings and payment statements for charges you don’t recognize. Early detection makes it easier to dispute fraudulent transactions before they cause lasting financial harm.
Consult a Data Breach Attorney
If you believe your information was part of this incident, it may be worth speaking with a data breach attorney for a free case evaluation. An attorney can help you understand your rights and whether you qualify to join any potential legal action.
Because this situation is still developing, staying informed about official updates from Expedia Group is also important. Attorneys who track these cases can often explain what compensation, if any, may become available later.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.