In a statement shared with Forbes<\/a>, Expedia said it acted to contain the problem as soon as it found out and is investigating with outside security experts. “Our platforms remain safe to use for both travelers and partners,” the company said.<\/p>\n\n\n\n What Expedia has not<\/strong> said yet: which vendor it was, what customer information was taken, or how many people are affected. So treat the big numbers below as claims, not confirmed facts.<\/p>\n\n\n\n The group calls itself n0n. According to Cybernews<\/a> and Forbes, it claims to have stolen:<\/p>\n\n\n\n Australia’s Cyber Daily<\/a> reports the group has now posted a sample on the dark web containing hundreds of thousands of email addresses tied to travel data, like hotel stays and rewards points totals. Cyber Daily also notes that some of the data may be old, based on the dates in the files. Many of the email addresses had never shown up in earlier breaches.<\/p>\n\n\n\n Expedia hasn’t named the vendor. But security researchers at Wiz<\/a> and Sentra<\/a> documented an attack between October 14 and 26 in which someone used stolen credentials from Qubole, a cloud data company, to get into several of its customers’ cloud accounts and download data. Skift reports that Qubole was once an Expedia vendor, and that Sentra found former Qubole customers had never taken back the access they’d granted it.<\/p>\n\n\n\n Think of it like giving your house key to a cleaning service years ago, switching to a different cleaner, and never changing the locks. Then someone steals the old cleaner’s key ring. To be fair, Expedia hasn’t confirmed its breach is connected to Qubole, and the researchers haven’t publicly named Expedia as one of the affected customers.<\/p>\n\n\n\n According to research firm SOCRadar, cited by Cyber Daily, n0n’s break-ins have relied on weak or stolen passwords rather than fancy hacking tricks. That’s a good reminder that passwords are still the front door for most of these attacks, including attacks on regular people.<\/p>\n\n\n\n Let’s be honest, you probably can’t do anything about a company’s vendor getting hacked. What you can<\/em> control is how you respond to the messages that come next. And this kind of data is gold for scammers because it lets them sound like they know you.<\/p>\n\n\n\n We’ve already seen this movie. Cybernews points out that after Booking.com disclosed a breach in April 2026, customers reported phishing emails, phone calls and WhatsApp messages that referenced their real bookings. I wrote about a similar trick when scammers used real Frontier booking codes<\/a>, and again with the Wyndham app exposure<\/a>.<\/p>\n\n\n\n So expect messages like these over the next few weeks:<\/p>\n\n\n\n The tell isn’t whether they know your details. They might. The tell is that they want you to click, pay or share something right now<\/strong>.<\/p>\n\n\n\n If you already clicked a link or gave out your card, don’t panic. Call your bank or card company and ask for a new card, change the password on that account, and follow the step-by-step checklist at IdentityTheft.gov<\/a>. You can report scam messages to the FTC at ReportFraud.ftc.gov<\/a>.<\/p>\n\n\n\n Expedia Group runs some of the biggest travel brands in the country, including Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire and Trivago. If you’ve traveled at all in the last few years, there’s a decent chance your email is somewhere in its systems.<\/p>\n\n\n\n The timing makes it worse. Thanksgiving is November 26, and lots of us are booking flights, hotels and cabins for the holidays right now. A message about “your reservation” doesn’t look weird this time of year. It looks normal. That’s exactly what scammers count on.<\/p>\n\n\n\n The good news is that the fix is mostly habits, not money. Go to the app instead of the link, use a different password everywhere, and put a strong lock on your email. Do those three things and most of these scams bounce right off.<\/p>\n\n\n\n If you want the strongest lock for your email, a hardware security key is it. You plug it in or tap it on your phone when you sign in, so a scammer who tricks you out of your password still can’t get in. Google and Microsoft accounts both support security keys.<\/p>\n\n\n\n As an Amazon Associate I earn from qualifying purchases.<\/p>\n\n\n\n Expedia confirmed hackers got in through a vendor, but it hasn’t said what was taken or who is affected. Until it does, assume scammers may know your email, your home airport and maybe your travel history. Don’t click, don’t rush, and go straight to the app. Your vacation should be the only thing that’s a surprise this season.<\/p>\n\n\n\n Got a suspicious travel message you want a second opinion on? Send it my way through the Contact Us page<\/a>.<\/p>\n\n\n\n Like quick, no-jargon tech safety tips? Come find my daily shorts on YouTube<\/a>.<\/p>\n\n\n\n Expedia confirmed hackers got in through a vendor. Here’s what may have leaked, the travel scams to expect, and 10 minutes of steps to stay safe.<\/p>\n","protected":false},"author":1,"featured_media":908,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[123,121,340,314,192,290,315,291,168,292,289,312],"class_list":["post-911","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","tag-cybersecurity","tag-data-breach","tag-expedia","tag-holiday-scams","tag-holiday-travel","tag-hotel-rewards","tag-identity-theft","tag-password-security","tag-phishing","tag-security-key","tag-travel-scams","tag-two-factor-authentication"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tWhat the hackers claim they took<\/h2>\n\n\n\n
\n
![\"Illustration](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/phishing-email-scam-illustration.jpg\")
How did the hackers get in?<\/h2>\n\n\n\n
The scam you’re most likely to see<\/h2>\n\n\n\n
\n
Your 10-minute protection plan<\/h2>\n\n\n\n
\n
Why it matters to you<\/h2>\n\n\n\n
![\"A](\"https:\/\/pagesofwisdom.com\/wp-content\/uploads\/2026\/11\/yubikey-5-nfc-security-key-1.jpg\")
What I’d grab<\/h2>\n\n\n\n
\n
The bottom line<\/h2>\n\n\n\n
Sources<\/h2>\n\n\n\n
\n
![Wikimedia Commons<\/a>, CC BY-SA 4.0.<\/figcaption><\/figure>\n\n\n\nWhat I’d grab<\/h2>\n\n\n\nIf you want the strongest lock for your email, a hardware security key is it. You plug it in or tap it on your phone when you sign in, so a scammer who tricks you out of your password still can’t get in. Google and Microsoft accounts both support security keys.<\/p>\n\n\n\n\nYubico YubiKey 5 NFC<\/a>: a physical sign-in key for your email and other big accounts. It plugs into a regular USB-A port or taps against most phones, so a thief with your password still can’t get in.<\/li>\n\nYubico Security Key C NFC<\/a>: the simpler, cheaper version with a USB-C plug for newer laptops and phones. It does the passkey and two-step login job most people need.<\/li>\n<\/ul>\n\n\n\nAs an Amazon Associate I earn from qualifying purchases.<\/p>\n\n\n\nThe bottom line<\/h2>\n\n\n\nExpedia confirmed hackers got in through a vendor, but it hasn’t said what was taken or who is affected. Until it does, assume scammers may know your email, your home airport and maybe your travel history. Don’t click, don’t rush, and go straight to the app. Your vacation should be the only thing that’s a surprise this season.<\/p>\n\n\n\nGot a suspicious travel message you want a second opinion on? Send it my way through the Contact Us page<\/a>.<\/p>\n\n\n\nLike quick, no-jargon tech safety tips? Come find my daily shorts on YouTube<\/a>.<\/p>\n\n\n\nSources<\/h2>\n\n\n\n\nSkift: Expedia Confirms Cyberattack Through Third-Party Vendor (Nov. 12, 2026)<\/a><\/li>\n\nForbes (via Forbes Middle East): Russian Cyberattackers Hit Expedia, Nearly a Billion Traveler Records Exposed (Nov. 13, 2026)<\/a><\/li>\n\nCybernews: Nearly a billion traveler records at risk as hackers target Expedia<\/a><\/li>\n\nCyber Daily: Cyber extortion group claims breach of Expedia (Nov. 12, 2026)<\/a><\/li>\n\nWiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild<\/a><\/li>\n\nSentra: Inside the Qubole Supply Chain Attack<\/a><\/li>\n\nHave I Been Pwned<\/a><\/li>\n\nFTC: IdentityTheft.gov data breach steps<\/a><\/li>\n\nFTC: ReportFraud.ftc.gov<\/a><\/li>\n<\/ul>\n\n\n","protected":false},"excerpt":{"rendered":"Expedia confirmed hackers got in through a vendor. Here’s what may have leaked, the travel scams to expect, and 10 minutes of steps to stay safe.<\/p>\n","protected":false},"author":1,"featured_media":908,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[123,121,340,314,192,290,315,291,168,292,289,312],"class_list":["post-911","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech","tag-cybersecurity","tag-data-breach","tag-expedia","tag-holiday-scams","tag-holiday-travel","tag-hotel-rewards","tag-identity-theft","tag-password-security","tag-phishing","tag-security-key","tag-travel-scams","tag-two-factor-authentication"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t](\"https:\/\/commons.wikimedia.org\/wiki\/File:YubiKey_5_NFC.png\"){kind=link}