Key developments
Booking.com confirms reservation data breach
Booking.com confirmed in April 2026 that unauthorized third parties accessed sensitive reservation data and said the incident was contained. Reporting from AltexSoft said traveler notifications began over the weekend, while the Medium post said exposed data included phone numbers, reservation details, hotel names, and trip dates, but not payment data. Booking.com also reset PINs for affected bookings, indicating the access could support impersonation and travel-scam attempts.
Why it matters
Reservation metadata can be reused for convincing phishing, smishing, and impersonation scams even without card exposure.
Sources & driving stories
MEDIUM
Medium coverageALTEXSOFT
AltexSoft coverageMilan court lets Meta class action proceed
A Milan court approved a class action against Meta over Facebook data scraping involving Italian users, with the underlying conduct said to have occurred from January 2018 through September 2019 and been disclosed in 2021. The reporting cites Reuters figures of about 533 million affected users globally and roughly 35 million in Italy. Meta said it disagrees with the procedural ruling and expects the case to be dismissed.
Why it matters
The ruling keeps one of Europe’s largest Facebook privacy claims alive and could shape GDPR compensation litigation.
Sources & driving stories
PYMNTS.COM
PYMNTS.com coverageWorth noting
WORTH NOTING
Comcast settlement reaches payout stage
The $117.5 million deal creates a claims process for customers affected by the 2023 breach, with deadlines and compensation terms now public.
WORTH NOTING
Chime lawsuit targets April breach
The proposed class action alleges an April 2026 incident exposed customer PII and caused an outage, adding another active privacy case.
Still unclear
OPEN QUESTION
How broad is Booking.com's notification scope?
The reporting still leaves open which markets, partners, and access path were involved, which affects the scale of user risk.
OPEN QUESTION
Will Meta's class action survive appeal?
The court only cleared the case procedurally, so the next ruling will determine whether the privacy claim advances or ends.