Extortion group n0n claims theft of nearly one billion Expedia traveler records

The extortion group n0n claims it obtained data on nearly one billion Expedia travelers through a compromised third-party provider, posting the allegation on its leak site on Nov. 9, 2026.

Expedia confirmed to Skift on Nov. 12, 2026, that attackers reached its systems through a breached third-party data platform provider, characterizing the breach as a supply chain incident involving several companies. The company said it stopped the problem immediately upon learning of it and hired outside cybersecurity specialists to investigate. It said travelers and business partners can continue using its platforms safely, but it has not confirmed n0n’s reported figures and says its investigation remains ongoing.

Expedia Group said it was aware of a supply chain attack.

The claimed datasets include more than 58 million traveler profiles with home airports and account information, more than 333 million consumer account and credential records with password-like tokens linked to e-mail addresses, and over 830 million loyalty program records tied to 35 programs, including membership tiers, booking values, e-mail addresses, membership identifiers and points balances. The group also claims 72 million consumer matching records, 500,000 guest records with accommodation details, and almost 2.5 million credit card spending records linked to hashed e-mail addresses.

n0n says it took source code using live credentials captured during the intrusion, and suggested it holds a workforce-planning database backup from Oct. 21, 2026, though that claim has not been proven. None of the claimed data figures have been independently verified.

n0n emerged in September 2026 as a data-theft extortion group that uses no file encryption and relies on data exfiltration and threatened publication. The group’s leak site says it is responsible for 224 attacks since September, a self-reported figure that has not been independently verified. On the site, the group lists victims as numbered companies with a countdown timer marked pending exposure and names a company only if it does not pay.

The group marked its Expedia listing not paid and exposed, and n0n characterized the situation as a data exposure rather than a ransomware encryption incident. Victim organizations can stay fully operational during negotiations because the group does not encrypt files.

SOCRadar reported severe credential exposure linked to Expedia’s infrastructure in stealer logs — records harvested by malware that steals stored credentials — before the Nov. 9, 2026 claim, but said that telemetry does not by itself confirm that n0n exploited the credentials or that a compromise of Expedia’s systems occurred. It assigned a High threat level and High confidence to the Expedia N0n incident. CyberNetSec.io reported on Nov. 9, 2026 that n0n’s claim was entirely unverified and that the group had released no sample data or proof, and said Expedia had not confirmed a breach as of that date.

According to Forbes, ransom negotiator Alex Waintraub, who has no role in the Expedia matter, said n0n’s claims seem meant to push victims toward payment. Waintraub also said Expedia’s public confirmation is unusual and could weaken n0n’s pressure tactics.

Wiz and Sentra say attackers used a compromised key — an access credential obtained improperly — from vendor Qubole, which works with Google Cloud Platform, to enter Expedia’s big data platform. Expedia Group is headquartered in the United States and manages Expedia.com, Hotels.com, Vrbo, Orbitz, Travelocity, Hotwire, Trivago and additional travel brands worldwide.

The company reported $14.7 billion in revenue in 2025. SecurityAffairs describes it as the world’s second-largest online travel agency. Customers with accounts across Expedia’s brands may share underlying data, and it has yet to verify whether all named brands or its complete customer database were impacted.

The investigation must determine what data was accessed, whether claimed datasets were extracted, and how many customers and partners were affected. SOCRadar stated that GDPR covers European customers, CCPA covers California residents, and the FTC plus relevant state attorneys general ought to receive notification. Partner hotels, airlines and related organizations need notification about downstream exposure via API integrations and shared booking systems. SOCRadar recommended continued dark web and stealer-log monitoring and credential-hygiene checks while the claim remains unconfirmed.

Travelers should change their Expedia account passwords using a trusted device and avoid reusing those passwords on other services. Customers should enable multifactor authentication where available and sign in through the official app or website.

The stolen password-like tokens are hashed, but attackers may still crack them, and stolen e-mail addresses and points balances could be used to build convincing phishing messages. Customers should review loyalty balances for unauthorized point redemptions, monitor payment activity for unusual card transactions, and respond cautiously to unexpected e-mails, text messages, or phone calls concerning bookings, refunds, or loyalty points. They should also avoid clicking suspicious links that claim to give details on the Expedia breach.