Expedia has acknowledged a breach through a third-party data platform provider, raising concerns for account holders across its travel brands. Security Affairs reported on November 14, 2026 that Expedia confirmed the intrusion to Skift on Thursday, while extortion group n0n claims extensive data theft whose scale the company has not confirmed.
Expedia says its services remain safe for travelers and business partners while its investigation continues. The provider compromise also allowed attackers to reach other companies. For customers, the potential scope extends beyond Expedia’s main website: Security Affairs says Expedia, Hotels.com and Vrbo accounts may share a data pool.
Provider access opened the door
Security Affairs cites cybersecurity firms Wiz and Sentra as tracing the intrusion to a stolen vendor key from Qubole, a Google Cloud Platform partner. That key—a credential granting access to services—reportedly let the attackers enter Expedia’s big data platform through an already trusted connection.
This describes a supply chain attack: compromising a supplier provides a route into organizations that rely on it. N0n also alleges that it obtained active credentials through the same compromise and used them to steal source code.
Cybersecurity sites had publicized the group’s allegations earlier in the week, before Expedia’s acknowledgment. Expedia says it acted to contain the intrusion when it learned of it and engaged outside cybersecurity specialists to investigate.
Expedia, described by Security Affairs as the world’s second-largest online travel agency, reported $14.7 billion in revenue for 2025. Its brands include Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire and Trivago.
The alleged data spans accounts, loyalty and bookings
Security Affairs describes n0n as a newly established Russian extortion group claiming nearly one billion Expedia traveler records. Its detailed allegations cover several datasets; those record counts should not be read as a confirmed number of affected people.
The largest claimed collection comprises more than 830 million records from 35 loyalty programs, with email addresses, membership identifiers and points balances. Another 58 million traveler profiles allegedly contain home airports and account information, while 333 million consumer account records reportedly include password-like tokens.
N0n’s remaining claims encompass 72 million consumer matching records, nearly 2.5 million credit card spending records associated with hashed email addresses, and accommodation details in 500,000 guest records. Hashing converts information into a coded representation. Security Affairs also describes the allegedly stolen password-like tokens as hashed, while warning that attackers may still be able to crack them.
Loyalty information could make phishing—deceptive messages intended to trick recipients—more persuasive. For example, Security Affairs warns that an attacker could combine a customer’s email address with their points balance to create a convincing message.
Numbered victims and a countdown
N0n appeared in mid-September. Security Affairs cites SOCRadar as describing an operation centered on stealing data and demanding payment without deploying ransomware. The group’s leak website claims 224 attacks since September.
Its pressure tactic delays public identification: alleged victims receive numbered listings such as “Company 89” or “Company 90,” alongside a countdown labeled “pending exposure.” Names are revealed if payment is not made.
Ransom negotiator Alex Waintraub, who is not involved in the Expedia case, told Forbes that the claims appear intended to push victims toward payment. He characterized the anonymous listings and delayed naming as unusual. Security Affairs suggested that Expedia’s public acknowledgment could reduce the pressure created by that approach.
For travelers, Security Affairs recommends changing Expedia account passwords from a trusted device and avoiding reuse of those passwords on other services.
