Booking.com Confirms Data Breach Affecting Customer Personal Information

Booking.com, one of the world’s largest online travel platforms, has confirmed that unauthorised third parties may have accessed customer data, including names, email addresses, physical addresses, phone numbers, and booking details. The company notified affected customers this past week, alerting them to the potential exposure of their personal information.

In a message sent to users, Booking.com stated: “We’re writing to inform you that unauthorized third parties may have been able to access certain booking information associated with your reservation.” The notification, which was shared by multiple customers on social media platforms such as Reddit, also warned that any additional information voluntarily shared with accommodation providers could have been compromised.

One affected user reported receiving a phishing message via WhatsApp two weeks prior to the notification, which included booking details and personal information. This suggests that hackers may be leveraging the stolen data to target Booking.com customers through further scams.

Booking.com spokesperson Courtney Camp confirmed the incident, stating: “We noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information. Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests.”

When pressed for details on the number of affected customers, the company declined to provide specifics. However, it assured The Guardian that financial information was not accessed during the breach.

This incident adds to a growing list of cybersecurity concerns in the travel industry. In 2024, TechCrunch reported that several hotels’ computers had been infected with consumer-grade spyware, or stalkerware. In one case, a victim logged into their Booking.com administration portal had their screen captured by PcTattleTale stalkerware, highlighting vulnerabilities in the sector.

Booking.com, which has facilitated over 6.8 billion hotel and home bookings since 2010, plays a central role in global travel. The breach raises questions about the security measures in place to protect the vast amounts of personal data handled by such platforms.

As the investigation continues, affected customers are advised to remain vigilant against phishing attempts and to monitor their accounts for any unusual activity. The incident underscores the ongoing challenges faced by major corporations in safeguarding user data in an increasingly digital world.