AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Travel and Hospitality Data Breaches
Coverage from NDTV, Captain Compliance, and others
Travel and hospitality platforms hold detailed information about guests and their plans, including names, contact details, reservation records, and messages shared with accommodations.
When that information is exposed through a direct compromise or a vendor or partner account, it can enable highly convincing phishing and impersonation even when payment-card data is not accessed. The Booking.com breach reports illustrate the pattern: unauthorized access to reservation-linked information, customer notifications, changed reservation PINs, and warnings to verify messages through official channels. The subject also includes disclosure practices, regulatory scrutiny, containment, and longer-term security responsibilities across interconnected travel services.
Looking Back
2771 Day Timeline
Nov '18
Apr '20
Jun '21
Oct '22
Dec '23
Apr '25
Jun '26
All Articles41 articles
Important
Reqrea’s Tabiq hotel check-in platform exposed over one million passports and selfie verification photos online after an Amazon cloud bucket misconfiguration was discovered in Japan.
5/16/2026 • Data Breaches & Exposure Events • General
Hospecs confirmed a shared booking software breach on or around June 3, 2026, exposing reservation data for at least 100 Dutch hotels and prompting AP investigation.
6/6/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers on 13 April 2026 that compromised hotel-partner accounts enabled reservation-data access used for reservation-hijack payment scams.
5/31/2026 • Data Breaches & Exposure Events • General
Reqrea secured a misconfigured Amazon cloud storage bucket after researcher Anurag Sen and TechCrunch alerted JPCERT to worldwide exposure of passport and ID documents.
5/18/2026 • Data Breaches & Exposure Events • General
Anurag Sen reported a long-running public Amazon S3 exposure of Reqrea's Tabiq hotel identity documents and facial verification photos, prompting rapid containment.
5/16/2026 • Personal Data & Identity • General
Booking.com disclosed a breach after suspected third party access to reservation data, prompting customer notifications and PIN updates.
4/22/2026 • Data Breaches & Exposure Events • General
Booking.com disclosed a data breach in which personal data such as names, addresses, and reservations were exposed, raising risk of personalized phishing scams.
4/15/2026 • Data Breaches & Exposure Events • General
Booking.com reported a reservation-data breach and introduced new reservation PINs after suspected hacker access potentially exposed customers in affected reservations.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com reported a third-party incident involving unauthorized access to some reservation records and issued PIN code changes after containment actions.
4/14/2026 • Data Breaches & Exposure Events • General
Interesting
Booking.com confirmed unauthorized access to customer booking data after partner-targeted phishing and spoofed emails, with alerts and reservation PIN updates following containment.
4/14/2026 • Cybersecurity (Privacy-Relevant) • General
Booking.com confirmed in April 2026 that unauthorized third parties accessed reservation data, exposing PII used for targeted phishing and impersonation.
4/15/2026 • Data Breaches & Exposure Events • General
Hospecs reported a breach impacting at least 100 Dutch hotels, exposing reservation data and enabling phishing and fake payment requests for guests.
6/3/2026 • Data Breaches & Exposure Events • General
KasadaIQ reported Booking.com reservation data exposure and described Dabai Guarantee Telegram marketplaces as AI-driven fraud markets expanded in Q1 2026.
4/30/2026 • Data Breaches & Exposure Events • General
Federman & Sherwood is investigating Travala Pte. Ltd. after a reported unauthorized-access data breach was submitted to the Nebraska Attorney General.
7/1/2026 • Data Breaches & Exposure Events • General
BWH Hotels warned hotel guests about fraudulent messages after unauthorized access to reservation-associated contact data between October 14, 2025 and April 22.
6/14/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed an unauthorized reservation-information breach and warned travellers about phishing messages using booking details delivered via email and WhatsApp.
5/19/2026 • Data Breaches & Exposure Events • General
BWH Hotels disclosed between October 2025 and April 2026 unauthorized access to a guest reservation web application, exposing names, contact details, and booking information.
5/12/2026 • Data Breaches & Exposure Events • General
Booking.com reported an April 2026 breach with leaked contact and reservation details that facilitates reservation hijacking impersonation scams.
5/10/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed a data breach on 2026-04-12 affecting reservation details and contact information, while stating payment information was not accessed.
4/22/2026 • Data Breaches & Exposure Events • General
Booking.com reported a potential customer data breach in the Netherlands, after UK users reported phishing emails and messages aimed at password resets.
4/20/2026 • Data Breaches & Exposure Events • General
Booking.com reported a reservation hijack on April 13, 2026, exposing user personal data and booking history while stating no financial data access occurred.
4/20/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers in response to a suspected data breach involving unauthorized access to reservation-linked personal information, while stating payment data was not accessed.
4/17/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed a reservation-data breach after unauthorized access to booking information, notified customers, updated PINs, and warned about reservation hijack fraud scams.
4/17/2026 • Data Breaches & Exposure Events • General
Booking.com disclosed unauthorized access to reservation-linked traveler personal data over the weekend and began notifications while stating payment data was not exposed.
4/14/2026 • Data Breaches & Exposure Events • General
Booking.com disclosed an unauthorized third-party incident affecting some guests' booking details, detected and contained after suspicious activity, with reservation PIN code resets and user guidance.
4/14/2026 • Data Breaches & Exposure Events • General
Booking.com issued new reservation PINs after unauthorized third parties accessed booking-linked data, enabling impersonation scams via WhatsApp, email, and SMS.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers after hackers accessed reservation data over a weekend, potentially exposing names and contact details and prompting PIN resets and phishing warnings.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com informed customers via email in 2026 that unauthorized parties may have accessed reservation booking information and updated reservation PIN numbers.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers after suspected unauthorized third-party access to reservation-linked personal data, issued PIN resets and phishing warnings, and said no payment data was accessed.
4/13/2026 • Data Breaches & Exposure Events • General
Marriott discloses a data breach affecting up to 500 million Starwood guests dating back to 2014 in the online booking system.
11/30/2018 • Data Breaches & Exposure Events • General
BWH Hotels disclosed April 22 detection of a third-party intrusion exposing guest identity and reservation data dating to October 14, 2025, affecting hotel customers while omitting payment data.
5/11/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed in the 2020s that unauthorized third parties accessed reservation-linked customer data, triggering containment, PIN updates, and guest notifications.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers after suspicious activity raised concerns about unauthorized access to reservation contact details, with notifications and reservation PIN updates following the discovery.
4/14/2026 • Data Breaches & Exposure Events • General
Booking.com notified users in the 2020s after suspicious activity tied to reservations may have exposed booking and contact details, leading to PIN resets and phishing warnings.
4/14/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed a Sunday evening data breach after suspicious activity potentially exposed reservation and contact data for some guests.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com confirmed a Sunday evening data breach after suspicious activity, warning that unauthorized third parties may have accessed customer reservation details and notifying affected guests.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com said unauthorized third parties may have accessed reservation-associated information, prompting PIN resets and direct email alerts to impacted users.
4/13/2026 • Data Breaches & Exposure Events • General
Booking.com notified customers after discovering unauthorized third-party access to some booking information, updating reservation PINs, and reporting no financial data access.
4/13/2026 • Data Breaches & Exposure Events • General
Scammers in San José, Costa Rica used Booking.com reservation data to impersonate Hilton staff and collect payments outside standard booking channels.
5/4/2026 • Data Breaches & Exposure Events • General
On April 13, 2026, Booking.com confirmed unauthorized access while Anodot and OpenAI faced cloud and supply-chain incidents, alongside actively exploited vulnerabilities affecting privacy-relevant data.
4/14/2026 • Data Breaches & Exposure Events • General
Booking.com notified travelers of unauthorized access to booking data, issued new PINs, and left breach scope and remediation details unspecified.
4/22/2026 • Data Breaches & Exposure Events • General