Booking.com confirms data breach exposing guest reservation details - phishing wave already targeting travelers

Booking.com has confirmed unauthorized access to its systems that exposed guest reservation data including names, email addresses, phone numbers, postal addresses, booking details, and any messages shared with accommodation providers. The company began emailing affected customers over the weekend but did not send alerts via the Booking.com app, creating confusion about whether the notification emails were legitimate. Booking.com says financial data was not accessed. The company has reset PIN numbers for affected reservations. The number of impacted users has not been disclosed, though Booking.com lists 6.8 billion bookings since 2010 across 30+ million properties. Reddit users are already reporting scam messages from people who appear to have real reservation details, suggesting attackers are using the stolen data for targeted phishing. The Register notes this follows a similar 2021 breach pattern where attackers compromised hotel staff logins to access the platform.

Check

If you or your employees have upcoming Booking.com reservations, be on high alert for phishing emails and messages that reference real booking details. The scams will look convincing because the attackers have the actual reservation data.

Affected

Anyone with active or recent Booking.com reservations. The exposed data (names, emails, phones, addresses, booking details, messages to hotels) gives attackers everything needed for highly targeted phishing.

Fix

Do not click links in any emails claiming to be from Booking.com or your booked hotel - go directly to booking.com to check your reservations. Verify that your booking PIN has been reset (Booking.com says they've done this automatically). Watch for emails requesting payment changes, 'verification' of card details, or 'reservation confirmations' that link to non-booking.com domains. If you uploaded passport or ID copies for your reservation, monitor for identity fraud. Note that passport/ID exposure was not confirmed by Booking.com but many hotels require these documents.