Expedia Data Breach: Supply-Chain Hack Confirmed

Was Expedia hacked?

Yes: on 12 November 2026 Expedia Group confirmed that attackers reached its systems through a compromised third-party data platform provider, in a supply-chain attack that also hit other companies ^[1].

In a statement to the travel-industry publication Skift, Expedia said it was "aware of a supply chain attack, reported by security researchers" ^[1]. Skift reports that Expedia described attackers compromising a third-party data platform provider and using that access to reach multiple companies ^[1]. Skift reports that Expedia also said it contained the issue as soon as it became aware, is investigating with outside security experts, and that its platforms remain safe for travellers and partners ^[1].

What Expedia did not say matters as much ^[1]:

• It did not name the compromised vendor.
• It did not say what customer information, if any, was exposed.
• It did not give the number of people affected.

The confirmation came after several cybersecurity sites reported claims by an extortion group called n0n that it had stolen Expedia data ^[1]. Expedia Group runs brands including Expedia, Hotels.com, Vrbo, Travelocity, Hotwire, Orbitz and Trivago ^[5].

What data does the n0n group claim to have?

n0n claims to have stolen more than one terabyte of Expedia data, mostly customer records, but none of its figures has been confirmed by Expedia ^[5][1]. According to Cybernews, the group threatened to publish the data unless Expedia reached a settlement ^[4]; Skift notes no specific ransom appeared on its dark-web page ^[1].

The group's claimed haul, as reported by Cybernews and Cyber Daily, includes ^[4][5]:

• 830,069,282 rows of loyalty-programme data across 800 files, with email addresses, member IDs, points balances in 21 currencies and booking values for 35 named programmes.
• About 58 million traveller profile rows with email addresses, account dates and home airports.
• About 333 million consumer account records pairing account IDs and email addresses with "password-like tokens".
• Booking event files with order numbers, itinerary IDs and booking values, plus 22-23 million trip records.
• Nearly 500,000 guest communication records.

Row counts are not the same as the number of people: one person can appear in many rows and files. The group also claimed access to source code and production cloud systems ^[4].

Has any of the Expedia data been leaked?

Cyber Daily reported on 12 November 2026 that n0n has published part of the alleged dataset on the dark web ^[5]. The compressed archive contains 11 folders listing hundreds of thousands of email addresses linked to travel data, including log-in details, hotel stays, communications and loyalty details such as traveller user IDs and points totals ^[5].

Two cautions apply ^[5]:

• Several of the email addresses had appeared in earlier breaches, according to Have I Been Pwned, though many had not.
• Date ranges in several files suggest the data may be historical rather than current.

Cyber Daily said Expedia declined to comment on the hackers' specific claims ^[5]. Cyber Daily cites a 3 November leak post by n0n as the first claim ^[5]. Until Expedia or an independent investigator publishes findings, the size and freshness of any leak remain unverified.

How did the Expedia supply-chain attack work?

Expedia has said only that a third-party data platform provider was compromised and its trusted access was abused ^[1]. Security researchers have separately documented a campaign involving Qubole, a cloud data platform; Skift reports that the researchers have not publicly named Expedia as an affected customer ^[1].

Cloud security firm Wiz, working with Sentra and Mandiant, reported that between 14 and 26 October 2026 an attacker used IAM credentials from an AWS account associated with Qubole, a big-data platform, to assume roles that customers had created to trust Qubole ^[3]. Once inside, the attacker listed resources, collected secrets from AWS Secrets Manager, SSM Parameter Store and Lambda settings, tested stolen keys with the TruffleHog tool, and downloaded data from S3 storage buckets ^[3][2].

Wiz said most of the roles used were otherwise idle: the trust policies were still in place, so the requests succeeded ^[3]. Sentra found former Qubole customers had never revoked the access they granted, and confirmed dozens of victims, with millions of files taken from one customer alone ^[1][2]. Qubole was once an Expedia vendor, but Expedia has not confirmed whether its breach is related ^[1].

AWS told BleepingComputer its services "were not compromised by this issue and operated as designed"; the attacker used credentials linked to a third-party provider ^[2].

What should Expedia customers do now?

The most likely risk for customers is targeted phishing: security researchers warn that scammers could use booking details to send convincing messages ^[4]. These steps follow from what is known so far:

1. Be suspicious of booking messages you did not expect, especially ones that mention real trips, points balances or loyalty tiers and ask you to pay, "verify" a card or log in through a link ^[4].
2. Open the Expedia app or type the website address yourself rather than following links in emails, texts or WhatsApp messages. What Is Phishing? How to Recognise Fake Emails, Texts and QR Codes covers the warning signs.
3. Change your password if you reuse it elsewhere, because the group claims to hold "password-like tokens" ^[4]; a unique password limits the damage.
4. Turn on two-step verification where your travel accounts offer it; Two-Factor Authentication Explained: Which 2FA Method Is Safest? explains which methods are strongest.
5. Check whether your email appears in known breaches; Cyber Daily used Have I Been Pwned to compare the leaked emails ^[5]. Was My Data Leaked? How to Check and What to Do After a Data Breach explains what to do next.

Travel phishing after breaches is not hypothetical. After Booking.com disclosed a breach of customer booking data in April 2026, customers reported phishing emails, calls and WhatsApp messages referencing their bookings ^[4].

What should companies using cloud data vendors check?

Administrators should look for unexpected role use by vendor accounts and remove trust relationships they no longer need ^[2][3].

• Review AWS CloudTrail logs from 1 October onward for suspicious access from Qubole's AWS account, then investigate any later secret and S3 access ^[2].
• Rotate credentials that may have been exposed and revoke active role sessions ^[2].
• Remove unused integrations and restrict remaining roles' permissions, trusted identities and allowed source networks ^[2].
• Look for role session names starting with "quiam-", which Wiz saw the attacker use consistently, such as quiam-enum ^[3].

AWS's own advice is to regularly review cross-account IAM roles, remove access for integrations no longer in use, grant least-privilege permissions and add conditions such as source IP restrictions to role trust policies ^[2]. Sentra observed the attacker collecting secrets at a rate of 100 passwords and keys in seven minutes, so fast detection matters ^[2].

Who is the n0n extortion group?

n0n is a relatively new extortion actor that emerged in September 2026 and claimed 204 victims in October alone, according to Cyber Daily ^[5]. It had listed more than 100 further victims so far in November (as of 12 November), many only by number on its leak site ^[5].

Security firm SOCRadar, quoted by Cyber Daily, said it found an exposed staging server tied to an n0n operator in September 2026, revealing tools, extortion infrastructure and an AI coding agent environment backed by more than US$7,000 in paid AI model usage ^[5]. What Are AI Agents? How They Work, What They Can Do and Where They Fail explains how such agents work. SOCRadar said n0n relies on compromised credentials rather than known vulnerabilities, and that it found no exploit payloads or CVE references; documented entry points include credential stuffing against VPN portals, weak remote-access passwords and exposed AWS keys ^[5].

Some threat-intelligence analysts had doubted the group's claims, Cyber Daily reports, but many now see it as a serious emerging threat even if it is not a traditional ransomware operator ^[5].

What happens next?

The key open questions are which vendor was compromised, what data was actually exposed and whether Expedia will notify affected customers ^[1]. So far Expedia has not said that customer data was involved ^[1].

Watch for three things: a formal notice from Expedia to customers or regulators; findings from its outside investigators; and whether security researchers link the Expedia incident to the Qubole campaign ^[1][3]. Until then, the large record counts circulating online should be treated as the attackers' claims ^[4][5].