Hackers Say They Stole Nearly a Billion Expedia Records. Here’s How to Keep Your Holiday Trip Scam-Free

If you’ve ever booked a hotel, flight or rental car on Expedia, Hotels.com, Vrbo, Orbitz, Travelocity or Hotwire, this one’s for you. Expedia Group confirmed on Thursday that hackers got into its systems through one of its tech vendors. A brand-new hacking group says it walked away with nearly a billion travel records.

Nobody needs to cancel their Thanksgiving trip over this. But with the holidays coming up and a lot of us booking travel right now, it’s the perfect moment for scammers to send you a very convincing “problem with your reservation” message. Here’s what we know, what we don’t, and the ten minutes of cleanup worth doing today.

What Expedia actually confirmed

Expedia Group told the travel news site Skift on Thursday, November 12, that attackers broke into a “third-party data platform provider” and then used that company’s trusted access to reach systems at several businesses, Expedia included. Security folks call this a supply chain attack. In plain English, the burglars didn’t pick Expedia’s lock. They stole a key from a company Expedia had already handed one to.

In a statement shared with Forbes, Expedia said it acted to contain the problem as soon as it found out and is investigating with outside security experts. “Our platforms remain safe to use for both travelers and partners,” the company said.

What Expedia has not said yet: which vendor it was, what customer information was taken, or how many people are affected. So treat the big numbers below as claims, not confirmed facts.

What the hackers claim they took

The group calls itself n0n. According to Cybernews and Forbes, it claims to have stolen:

• About 830 million rows of loyalty program data, including email addresses, member IDs, points balances, membership tiers and booking values across 35 rewards programs.
• About 58 million traveler profiles with email addresses, account dates and home airports.
• About 333 million account records that pair account IDs and email addresses with what Cybernews describes as “password-like tokens.”
• Booking files with order numbers and itinerary IDs, plus nearly 23 million trip records.
• About 2.4 million card spending records, which Cybernews says are keyed to scrambled (hashed) email addresses rather than plain card numbers.
• Nearly 500,000 guest messages that include accommodation details.

Australia’s Cyber Daily reports the group has now posted a sample on the dark web containing hundreds of thousands of email addresses tied to travel data, like hotel stays and rewards points totals. Cyber Daily also notes that some of the data may be old, based on the dates in the files. Many of the email addresses had never shown up in earlier breaches.

How did the hackers get in?

Expedia hasn’t named the vendor. But security researchers at Wiz and Sentra documented an attack between October 14 and 26 in which someone used stolen credentials from Qubole, a cloud data company, to get into several of its customers’ cloud accounts and download data. Skift reports that Qubole was once an Expedia vendor, and that Sentra found former Qubole customers had never taken back the access they’d granted it.

Think of it like giving your house key to a cleaning service years ago, switching to a different cleaner, and never changing the locks. Then someone steals the old cleaner’s key ring. To be fair, Expedia hasn’t confirmed its breach is connected to Qubole, and the researchers haven’t publicly named Expedia as one of the affected customers.

According to research firm SOCRadar, cited by Cyber Daily, n0n’s break-ins have relied on weak or stolen passwords rather than fancy hacking tricks. That’s a good reminder that passwords are still the front door for most of these attacks, including attacks on regular people.

The scam you’re most likely to see

Let’s be honest, you probably can’t do anything about a company’s vendor getting hacked. What you can control is how you respond to the messages that come next. And this kind of data is gold for scammers because it lets them sound like they know you.

We’ve already seen this movie. Cybernews points out that after Booking.com disclosed a breach in April 2026, customers reported phishing emails, phone calls and WhatsApp messages that referenced their real bookings. I wrote about a similar trick when scammers used real Frontier booking codes, and again with the Wyndham app exposure.

So expect messages like these over the next few weeks:

• “Your hotel reservation could not be confirmed. Re-enter your card within 24 hours or it will be canceled.”
• “Your rewards points are about to expire. Log in here to keep them.”
• A call or text from “Expedia support” that knows your name, your home airport and maybe even the hotel you booked, offering to “fix” a problem.
• A “refund” or “security deposit” request that asks you to pay through a link, a gift card or a payment app.

The tell isn’t whether they know your details. They might. The tell is that they want you to click, pay or share something right now.

Your 10-minute protection plan

• Don’t click booking links in texts or emails. If a message says something’s wrong with your trip, close it and open the Expedia (or Hotels.com or Vrbo) app yourself, or type the website address. If there’s a real problem, you’ll see it in your account.
• Never “re-enter” your card through a link. If a hotel or airline really needs something, call them using the number on their official website or your confirmation, not the number in the message.
• Change your Expedia password, especially if you use the same password anywhere else. Then change it on those other sites too. Reused passwords are how one breach turns into five.
• Lock down your email first. Your email is the master key, because every “forgot password” link goes there. Turn on two-step verification, ideally with an authenticator app, a passkey or a security key.
• Check your rewards points. Log in and make sure your points balance looks right. Points are basically cash to a thief.
• See if your email has shown up in breaches. The free site Have I Been Pwned lets you type in your email and see which known breaches it appears in.
• Turn on card alerts. Most banking apps can text you for every charge. It’s the fastest way to catch a fake charge.

If you already clicked a link or gave out your card, don’t panic. Call your bank or card company and ask for a new card, change the password on that account, and follow the step-by-step checklist at IdentityTheft.gov. You can report scam messages to the FTC at ReportFraud.ftc.gov.

Why it matters to you

Expedia Group runs some of the biggest travel brands in the country, including Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire and Trivago. If you’ve traveled at all in the last few years, there’s a decent chance your email is somewhere in its systems.

The timing makes it worse. Thanksgiving is November 26, and lots of us are booking flights, hotels and cabins for the holidays right now. A message about “your reservation” doesn’t look weird this time of year. It looks normal. That’s exactly what scammers count on.

The good news is that the fix is mostly habits, not money. Go to the app instead of the link, use a different password everywhere, and put a strong lock on your email. Do those three things and most of these scams bounce right off.

What I’d grab

If you want the strongest lock for your email, a hardware security key is it. You plug it in or tap it on your phone when you sign in, so a scammer who tricks you out of your password still can’t get in. Google and Microsoft accounts both support security keys.

• Yubico YubiKey 5 NFC: a physical sign-in key for your email and other big accounts. It plugs into a regular USB-A port or taps against most phones, so a thief with your password still can’t get in.
• Yubico Security Key C NFC: the simpler, cheaper version with a USB-C plug for newer laptops and phones. It does the passkey and two-step login job most people need.

As an Amazon Associate I earn from qualifying purchases.

The bottom line

Expedia confirmed hackers got in through a vendor, but it hasn’t said what was taken or who is affected. Until it does, assume scammers may know your email, your home airport and maybe your travel history. Don’t click, don’t rush, and go straight to the app. Your vacation should be the only thing that’s a surprise this season.

Got a suspicious travel message you want a second opinion on? Send it my way through the Contact Us page.

Like quick, no-jargon tech safety tips? Come find my daily shorts on YouTube.

Sources

• Skift: Expedia Confirms Cyberattack Through Third-Party Vendor (Nov. 12, 2026)
• Forbes (via Forbes Middle East): Russian Cyberattackers Hit Expedia, Nearly a Billion Traveler Records Exposed (Nov. 13, 2026)
• Cybernews: Nearly a billion traveler records at risk as hackers target Expedia
• Cyber Daily: Cyber extortion group claims breach of Expedia (Nov. 12, 2026)
• Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild
• Sentra: Inside the Qubole Supply Chain Attack
• Have I Been Pwned
• FTC: IdentityTheft.gov data breach steps
• FTC: ReportFraud.ftc.gov