Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
Booking.com Reservation Breaches
Coverage from WebProNews, The Guardian, and others
Articles
46
Active Days
2797
The Topic
This topic centers on Booking.com and related travel booking portals exposing traveler data through breaches, suspicious access, or insecure third-party systems. The disclosed information commonly includes names, email addresses, phone numbers, addresses, reservation details, and, in some cases, accommodation communications or passport images. The main significance is not direct financial theft but the way booking data can be reused for phishing, reservation hijacking, and other targeted scams.
First Article: 11/30/18
Latest Article: 07/27/26
Summary
- Booking.com repeatedly appears as the central platform, with multiple disclosures tied to unauthorized access to reservation-linked data.
- Exposed data is usually enough to support convincing phishing or reservation-hijacking scams, even when financial data is not reported as accessed.
- The incidents affect traveler identity and trip details, including names, email addresses, phone numbers, addresses, and booking history.
- Booking.com and affected portals responded by containing access, updating reservation PINs, and notifying users.
- The material points to a broader pattern of travel-booking systems being used as a scam surface after initial data exposure.
- A third-party UK visa portal adds a related privacy exposure pattern involving passport scans and selfie images stored in public cloud storage.
History
The story has shifted from a Booking.com-centered pattern of travel-data exposure to a broader hospitality-breach cluster, with a new Dutch hotel incident showing shared software can propagate exposure across many properties. It also now includes stronger enforcement context, including prior regulatory penalties and a fresh GDPR investigation.
The story has broadened from Booking.com reservation breaches into a wider travel-data exposure pattern that now includes a UK visa portal leaking passport scans and selfies. The framing has also shifted toward vendor and cloud-security failures, with incomplete disclosure emerging as a recurring concern.
Featured
05-16-2026
Anurag Sen reported a long-running public Amazon S3 exposure of Reqrea's Tabiq hotel identity documents and facial verification photos, prompting rapid containment.
04-13-2026
Booking.com notified customers after discovering unauthorized third-party access to some booking information, updating reservation PINs, and reporting no financial data access.
05-11-2026
BWH Hotels disclosed April 22 detection of a third-party intrusion exposing guest identity and reservation data dating to October 14, 2025, affecting hotel customers while omitting payment data.
Timeline: 2797 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Reqrea’s Tabiq hotel check-in platform exposed over one million passports and selfie verification photos online after an Amazon cloud bucket misconfiguration was discovered in Japan.
Hospecs reported a breach impacting at least 100 Dutch hotels, exposing reservation data and enabling phishing and fake payment requests for guests.
Researchers reported a data leak in the UK Visa Portal third-party travel authorization website in the UK, exposing up to 100,000 identity documents in public cloud storage.
Hospecs confirmed a shared booking software breach on or around June 3, 2026, exposing reservation data for at least 100 Dutch hotels and prompting AP investigation.
Reqrea secured a misconfigured Amazon cloud storage bucket after researcher Anurag Sen and TechCrunch alerted JPCERT to worldwide exposure of passport and ID documents.
TechCrunch reported a third-party UK visa portal exposed at least 100,000 passport scans and GPS-bearing selfies on a public Amazon storage server before bucket security.
The LINE Los Angeles notified Koreatown guests in July 2026 after a September 2025 unauthorized network access incident may have exposed personal information filed with the California Attorney General.
LINE Los Angeles filed a California Attorney General data breach notice on July 24, 2026 after discovering unauthorized network access in September 2025.
Booking.com disclosed a data breach in which personal data such as names, addresses, and reservations were exposed, raising risk of personalized phishing scams.
Booking.com disclosed a breach after suspected third party access to reservation data, prompting customer notifications and PIN updates.
KasadaIQ reported Booking.com reservation data exposure and described Dabai Guarantee Telegram marketplaces as AI-driven fraud markets expanded in Q1 2026.
Booking.com reported a third-party incident involving unauthorized access to some reservation records and issued PIN code changes after containment actions.
Booking.com confirmed unauthorized access to customer booking data after partner-targeted phishing and spoofed emails, with alerts and reservation PIN updates following containment.
Booking.com notified customers on 13 April 2026 that compromised hotel-partner accounts enabled reservation-data access used for reservation-hijack payment scams.
Booking.com reported a reservation-data breach and introduced new reservation PINs after suspected hacker access potentially exposed customers in affected reservations.
Booking.com confirmed in April 2026 that unauthorized third parties accessed reservation data, exposing PII used for targeted phishing and impersonation.
⭐⭐⭐
Booking.com said unauthorized third parties may have accessed reservation-associated information, prompting PIN resets and direct email alerts to impacted users.
Booking.com confirmed a reservation-data breach after unauthorized access to booking information, notified customers, updated PINs, and warned about reservation hijack fraud scams.
Booking.com disclosed unauthorized access to reservation-linked traveler personal data over the weekend and began notifications while stating payment data was not exposed.
Booking.com confirmed an unauthorized reservation-information breach and warned travellers about phishing messages using booking details delivered via email and WhatsApp.
Booking.com reported a potential customer data breach in the Netherlands, after UK users reported phishing emails and messages aimed at password resets.
BWH Hotels disclosed between October 2025 and April 2026 unauthorized access to a guest reservation web application, exposing names, contact details, and booking information.
Gîtes de France reported a cyberattack affecting up to 389,000 European clients after May 18 breach notifications in France.
BWH Hotels warned hotel guests about fraudulent messages after unauthorized access to reservation-associated contact data between October 14, 2025 and April 22.
Booking.com notified customers in response to a suspected data breach involving unauthorized access to reservation-linked personal information, while stating payment data was not accessed.
Booking.com confirmed a data breach on 2026-04-12 affecting reservation details and contact information, while stating payment information was not accessed.
Booking.com notified users in the 2020s after suspicious activity tied to reservations may have exposed booking and contact details, leading to PIN resets and phishing warnings.
Booking.com notified travelers of unauthorized access to booking data, issued new PINs, and left breach scope and remediation details unspecified.
Booking.com notified customers after suspicious activity raised concerns about unauthorized access to reservation contact details, with notifications and reservation PIN updates following the discovery.
Booking.com confirmed in the 2020s that unauthorized third parties accessed reservation-linked customer data, triggering containment, PIN updates, and guest notifications.
Booking.com confirmed a Sunday evening data breach after suspicious activity, warning that unauthorized third parties may have accessed customer reservation details and notifying affected guests.
Booking.com confirmed a Sunday evening data breach after suspicious activity potentially exposed reservation and contact data for some guests.
On April 13, 2026, Booking.com confirmed unauthorized access while Anodot and OpenAI faced cloud and supply-chain incidents, alongside actively exploited vulnerabilities affecting privacy-relevant data.
Marriott discloses a data breach affecting up to 500 million Starwood guests dating back to 2014 in the online booking system.
Booking.com notified customers after hackers accessed reservation data over a weekend, potentially exposing names and contact details and prompting PIN resets and phishing warnings.
Booking.com reported a reservation hijack on April 13, 2026, exposing user personal data and booking history while stating no financial data access occurred.
Booking.com notified customers after suspected unauthorized third-party access to reservation-linked personal data, issued PIN resets and phishing warnings, and said no payment data was accessed.
Booking.com reported an April 2026 breach with leaked contact and reservation details that facilitates reservation hijacking impersonation scams.
Booking.com informed customers via email in 2026 that unauthorized parties may have accessed reservation booking information and updated reservation PIN numbers.
Booking.com disclosed an unauthorized third-party incident affecting some guests' booking details, detected and contained after suspicious activity, with reservation PIN code resets and user guidance.
Booking.com issued new reservation PINs after unauthorized third parties accessed booking-linked data, enabling impersonation scams via WhatsApp, email, and SMS.
UK Ministry of Justice confirmed May 2025 Legal Aid Agency data breach after online portal intrusion exposed about 2.1 million applicants since 2010.
Scammers in San José, Costa Rica used Booking.com reservation data to impersonate Hilton staff and collect payments outside standard booking channels.