Data Breach
Markus Spiske/Unsplash

Booking.com has confirmed a major cyber incident after 'unauthorised' third parties accessed the sensitive reservation details of millions of customers.

The breach, detected on 13 April 2026, has seen hackers harvest names, email addresses, phone numbers, and physical addresses from Booking.com systems. While the company maintains that financial data was not compromised, cybersecurity experts warn that the exposed, compromised booking details are being used to fuel a global wave of 'reservation hijacking' scams. These attacks use the stolen context of a real holiday to trick travellers into making fraudulent payments through official-looking channels.

The breach appears to have originated from a massive campaign targeting hotel partners rather than the central platform itself. Investigators have linked the activity to a criminal group known as Storm-1865, which reportedly used automated Python scripts to siphon data from over 170 hospitality facilities worldwide. This unauthorised access event at Booking.com has prompted the company to forcibly reset reservation PINs and issue an urgentphishing warning to its 100 million active app users.

According to reports, the compromised data may include names, email addresses, phone numbers, physical addresses, and booking details, essentially the core information tied to travel reservations.

While the company stated that financial information, such as credit card details, was not accessed, the exposed data remains highly sensitive.

In a notification sent to customers, the company acknowledged 'suspicious activity' affecting some reservations and said it had taken steps to contain the issue.

Crucially, the scale of the breach remains unclear, with no confirmed number of affected users disclosed.

How Are Scammers Exploiting The Breach?

What makes this incident particularly concerning is not just the data exposure, but how quickly it is being weaponised.

Cybercriminals are reportedly using stolen booking details to impersonate hotels or legitimate customer service representatives. Victims receive messages, often via email, WhatsApp, or in-app messaging, requesting payment verification or urgent action.

Why This Breach Is Especially Dangerous

Unlike typical data breaches that expose passwords or financial data, this incident highlights a different kind of vulnerability: contextual data.

Travel itineraries, accommodation details, and personal contact information can be enough to execute highly targeted phishing attacks. Experts warn that such information allows attackers to build trust quickly and manipulate victims into making payments outside official platforms.

This is particularly risky in the travel sector, where time-sensitive bookings and last-minute changes create pressure that scammers can exploit.

The incident also underscores a broader issue—online travel platforms have become prime targets due to the sheer volume of personal data they handle across global networks.

What Booking.com Has Said And Done

In response to the breach, Booking.com said it had taken immediate steps to secure affected systems and prevent further unauthorised access.

Measures reportedly include resetting reservation PIN codes and notifying impacted users directly.

The company has also urged customers to remain vigilant and avoid sharing payment details through unofficial channels.

It emphasised that legitimate requests for payment or verification should be made only through its official platform or app.

What Travellers Should Do Now

Customers with recent bookings are being advised to exercise heightened caution.

Key recommendations include:

  • Avoid clicking on suspicious links or responding to unsolicited payment requests
  • Verify any communication directly through official hotel contact details
  • Use the platform's app or website for all transactions
  • Monitor accounts for unusual activity

Users are also encouraged to report suspicious messages immediately, as scammers continue to exploit the breach in real time.

A Growing Pattern Of Travel Industry Cyber Threats

This incident is not isolated. The travel sector has become increasingly targeted by cybercriminals due to its reliance on interconnected systems and third-party providers.

Previous cases have shown that even limited access to booking data can lead to significant financial losses for consumers, particularly when phishing scams are involved.

The latest breach highlights how cyber threats are evolving, from simple data theft to sophisticated, real-time fraud campaigns that leverage stolen information almost instantly.

The Booking.com breach serves as a stark reminder that even when financial data remains secure, personal information alone can put travellers at risk.

As scammers become more sophisticated, the burden increasingly falls on users to verify communications and remain cautious, especially when their travel plans are suddenly used against them.

Writer's pick