vibecodai

Security

Expedia Data Breach: What's Confirmed, What Hackers Claim, and the Vendor Door Left Open

Updated

  • Consumer Security
  • Breaches
  • Explainer
Expedia Data Breach: What's Confirmed, What Hackers Claim, and the Vendor Door Left Open
Uploaded by the desk

Expedia Group has confirmed that attackers reached its systems through a compromised data vendor, while an extortion group claims to hold close to a billion rows of traveler data. Here is what is actually confirmed, what is only claimed, how a vendor's old access can become a way in, and what Expedia, Hotels.com and Vrbo customers should do now.

Updated November 14, 2026, 12:45 a.m. New York time (EST).

Expedia Group, which owns Expedia, Hotels.com, Vrbo, Orbitz, Travelocity and Hotwire, confirmed on Thursday, November 12, that it had been caught up in a supply chain attack. In a statement to the travel trade outlet Skift, the company said: "We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group." It said it contained the issue as soon as it became aware of it, is investigating with outside security experts, and that its platforms "remain safe to use for both travelers and partners."

That is a much narrower statement than the one spreading on social media, where posts describe "nearly 1 billion traveler records" taken from Expedia. That number comes from the attackers, not from Expedia or any independent investigator. The gap between the two matters, both for how worried customers should be and for what they should do. So does the likely mechanism behind the intrusion, which points to a problem far bigger than one travel company: access granted to a vendor years ago that nobody switched off.

What Expedia has confirmed, and what it has not

Expedia's statement establishes three things: an outside data platform provider was compromised; the attackers used that provider's trusted access to reach Expedia Group systems; and other companies were hit the same way.

It does not say which vendor was involved, when the intrusion happened, what data was accessed, which of its brands or countries are affected, or how many people are involved. Expedia has also not said whether it will notify individual customers.

There is no regulatory filing yet either. US-listed companies must file a Form 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material. When we checked the SEC's EDGAR database early on November 14, Expedia Group's most recent 8-K was its November 4 earnings release, and no Item 1.05 filing had been made. Its quarterly report on Form 10-Q, filed the same day, contains no mention of a cyber incident or breach. That is not evidence of wrongdoing: the clock runs from when a company decides an incident is material, not from when a criminal group makes a claim. But it means that, so far, Expedia has not reported the incident to investors as material.

What the attackers claim, and why the numbers need care

The claims come from a group calling itself n0n, which Cyber Daily reports first emerged in September. According to Cyber Daily, n0n posted Expedia on its leak site on November 3, saying it held more than one terabyte of data. As listed by Cybernews and Cyber Daily, the group says it has:

  • 830,069,282 rows of loyalty program data across 800 files and 35 programs, with email addresses, member IDs, tier names, booking values and points balances in 21 currencies;
  • 58.3 million traveler profiles containing email addresses, account dates and home airports;
  • 333.3 million account records pairing traveler account IDs and email addresses with what Cybernews describes as "password-like tokens";
  • nearly 23 million trip records, booking event files, and almost 500,000 guest communication records with accommodation details;
  • 2.4 million card network spending records keyed to hashed email addresses;
  • working credentials for Expedia's big data platform, source code repositories and a production cloud environment.

None of this has been independently verified, and Expedia has not addressed the figures. Cyber Daily, which examined a partial archive n0n later published, says it contains hundreds of thousands of email addresses linked to travel data, log-in details, hotel stays and loyalty details, and that some of the data "may be historical in nature" given the date ranges in several files.

Two cautions apply to the headline number. First, rows are not people. The same customer can appear in many rows, for example across several loyalty programs or over many years of records. Adding the categories together to reach "a billion travelers", as some posts do, double counts heavily. Second, "password-like tokens" is not the same as passwords. Nobody outside the attackers has said whether those values are hashed passwords, session tokens or something else, and that distinction decides whether stolen logins are usable.

Even so, the claimed categories are the kind that matter most to ordinary customers. Email addresses combined with real trip details, home airports and loyalty balances are exactly what a scammer needs to write a convincing message.

The Qubole question

Expedia did not name the vendor. But its description closely matches a campaign disclosed on November 9 by the cloud security firm Wiz and the data security company Sentra, investigating with Google's Mandiant.

According to Wiz, between October 14 and October 26 an attacker used credentials from an Amazon Web Services (AWS) account associated with Qubole, a big data processing platform owned by Idera since 2020, to step into the AWS accounts of Qubole's customers. Sentra says "dozens of Qubole customers were impacted." On November 11, Wiz added that, according to the Risky Business newsletter, "an actor calling themselves 'n0n' has claimed responsibility for this intrusion."

The circumstantial case for a link is strong:

  • Expedia describes "a third-party data platform provider" whose "trusted access" reached "multiple companies", and says the attack was "reported by security researchers". Wiz and Sentra's disclosure fits each part of that description.
  • Expedia was a Qubole customer. A 2019 guest post on Qubole's own blog, written by an Expedia Group senior data scientist, describes the company's data science work on the platform, and Skift calls Qubole "a onetime Expedia vendor".
  • The same group, n0n, has claimed both the Qubole intrusions and the Expedia data.

But it is not proven. Expedia has not named Qubole, Wiz and Sentra have not publicly listed Expedia among the affected organizations, and BreachNews reported on November 13 that Qubole and Idera had not made any public statement. Until one of those parties confirms it, the Qubole connection should be treated as likely, not established.

How a vendor you stopped using can still open the door

The Qubole campaign is worth understanding even apart from Expedia, because the weakness it exploited is common.

Cloud data tools often need to work inside a customer's own AWS account. The standard way to allow that is a cross-account role: the customer creates a role in its account and writes a "trust policy" saying that the vendor's AWS account may assume it. To guard against impersonation, AWS recommends adding an External ID, a code the vendor must present when it asks for access.

Wiz found that every request the attacker made included the correct External ID, "and every one succeeded." As far as AWS could tell, the attacker was Qubole. Amazon told BleepingComputer that "AWS services were not compromised by this issue and operated as designed." In other words, the trust relationships worked exactly as configured. The problem was what had been configured and then forgotten.

Wiz reports that "most of the roles the threat actor assumed were not otherwise in use," and that in a majority of the environments it observed, the attacker's requests were the only role assumptions from the vendor's account in October. Sentra put it more bluntly: "Qubole roles were still in place long after companies had stopped using Qubole," and in one case a platform the customer "had stopped using a while ago" still had roles that "could read nearly all of the source buckets."

Once inside, the attacker moved fast. Sentra counted about 100 passwords and keys read in seven minutes, and zero write actions: nothing changed or deleted, which makes theft harder to spot. Wiz says the attacker pulled secrets from AWS Secrets Manager, Parameter Store and Lambda settings, tested them with the open-source tool TruffleHog against AWS, Microsoft Entra ID and Okta, and downloaded storage buckets, "in some cases downloading entire buckets in a single session."

The most striking line in Wiz's report is about how little it would have taken to stop this. All legitimate Qubole traffic came from AWS infrastructure, while the attacker came through a rented server and a commercial VPN. Wiz says that adding a condition limiting role use to the vendor's known network addresses "alone would have blocked every role assumption we observed."

That is the broader lesson. Companies audit the vendors they use today. Far fewer audit the doors left by vendors they stopped using years ago. Those doors stay open, unwatched, and often with wide read access to the data that matters most.

What travelers should do now

Because Expedia has not said what was taken, these are precautions, not a response to a confirmed exposure of your account. They apply if you have used Expedia, Hotels.com, Vrbo, Orbitz, Travelocity, Hotwire or another Expedia Group brand.

  • Expect convincing scams. The most immediate risk from data like this is phishing that mentions a real trip, hotel, loyalty tier or points balance. Treat any unexpected message about a booking problem, refund, points transfer or "account verification" as suspect, even if it contains accurate details. Go to the app or type the website address yourself rather than tapping a link.
  • Change reused passwords. If your password for any Expedia Group site is also used elsewhere, change it on those other sites, starting with email, banking and other travel accounts. Whether the claimed account records contain usable passwords is unknown, but closing off reuse costs little.
  • Use stronger sign-in where offered. If your travel accounts offer a passkey or one-time sign-in codes, switch to them.
  • Watch loyalty balances and cards. Check points balances and recent bookings for activity you don't recognize, and review card statements.
  • Be wary of "replacement" offers. Breach news reliably brings fake compensation and refund messages. As of this update, Expedia had not announced any compensation process.

Vrbo hosts and property managers should be cautious too. n0n claims to hold reservation and guest communication records, which could be used to impersonate guests or the platform in requests for payment or changes to payout details.

What to watch next

Four developments would change the picture. An 8-K filing would mean Expedia has judged the incident material, and would have to describe its nature, scope and timing. Customer notification emails would show which brands and data types are actually involved. A statement from Qubole or Idera, or an update from Wiz or Sentra, could confirm or rule out the vendor link. And independent analysis of the leaked sample would show whether n0n's numbers hold up or, as often happens with extortion claims, shrink on inspection.

Until then, the honest summary is short. Expedia has confirmed that attackers came in through a vendor's trusted access. The billion-row figure is a criminal group's claim. And the likeliest route in, a data vendor's old keys that still worked after the work had stopped, is a risk many companies have not yet checked for in their own systems.

Sources

← Back to vibecodai homepage