Loading story…
Booking.com warned customers that unauthorized parties accessed personal information linked to some reservations, exposing data that may include booking details, names, email addresses, physical addresses, phone numbers, and information shared with accommodations. The company said it detected suspicious activity, contained the incident, changed reservation PINs, and notified affected guests, while stating that payment or other financial information was not accessed from its systems. Booking.com did not disclose how many customers were affected.
The breach was disclosed amid broader fraud and cybercrime pressure on the travel platform, including phishing and impersonation scams targeting Booking.com users. Reporting also highlighted rising consumer complaints and scam losses tied to travel-booking fraud, as well as scrutiny from an earlier Booking.com incident in which phishing against hotel staff exposed data from more than 4,000 people and later resulted in a €475,000 regulatory fine after delayed breach reporting in the Netherlands.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Booking.com warned affected guests that unauthorized parties may have accessed booking details, names, email addresses, physical addresses, phone numbers, and information shared with accommodations. It also advised customers to be alert for phishing and related scams.
Booking.com said it detected suspicious activity involving unauthorized access to some customers’ reservation-related information, took steps to contain the incident, and updated reservation PIN numbers. The company said financial information was not accessed from its systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourcethecyberthrone.in
Open sourcetechcrunch.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026Gen Threat Labs reported that **more than 350 accommodations in 50 countries** were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through **SMS, WhatsApp, email, and in-app messages**, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents. The findings followed **Booking.com** warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially **Germany, France, the United Kingdom, Italy, and Spain**—but the activity also reached the **United States** and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen **MFA**, account monitoring, endpoint protection, and staff phishing awareness.
Jun 29, 2026
Finland’s National Cyber Security Centre warned that phishing campaigns targeting hotel reservations are abusing **Booking.com** and related accommodation services with messages that look legitimate because they contain real booking details. Victims have received messages shortly after making reservations, sometimes through **Booking.com’s own messaging channel** and sometimes via **WhatsApp**, with references to genuine hotel names, customer identities, and actual reservation information. The messages often begin as routine confirmations before claiming there is a problem with the booking, identity verification, or payment card. The fraudulent messages direct travelers to spoofed websites designed to mimic hotel or booking pages and steal payment-card data. Finnish authorities said the accuracy of the information strongly suggests attackers obtained access to hotel or reservation accounts, likely through phishing or other account compromise, allowing them to view reservation records and in some cases prior conversation history. Officials said similar incidents have been reported for years, with a notable rise in reported cases, and advised customers to verify any payment or identity requests through independent contact channels with the hotel or booking provider.
Jun 29, 2026