Expedia Group has confirmed that attackers reached its systems through a compromised third-party data platform provider, days after the N0n extortion group claimed it had stolen more than 1 TB of Expedia data, including hundreds of millions of customer records.
The company has not named the vendor or said what information, if any, was taken. The confirmation came on Thursday, November 12, 2026, after Expedia had earlier declined to comment on the group’s claims.
What Expedia has confirmed
In a statement to travel industry outlet Skift, Expedia Group said: “We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group.”
The company said it contained the issue as soon as it became aware of it, is investigating with outside security experts, and that its platforms “remain safe to use for both travelers and partners.”
Expedia Group owns Expedia, Hotels.com, Vrbo, Orbitz, Travelocity and Hotwire, among other travel brands. It has not said which brands, customers or partners are affected, when the intrusion happened or how many people could be involved. As of November 13, the company had not filed a material cybersecurity incident report (Form 8-K Item 1.05) with the U.S. Securities and Exchange Commission.
N0n’s claimed haul
The N0n extortion group added Expedia Group to its data leak site in early November and later marked the company as a victim that had not paid. No ransom amount or deadline was listed. The group claims to hold more than 1 TB of data, including:
- 830,069,282 rows of loyalty program data across 800 files, covering 35 programs, with email addresses, member IDs, tier names, booking values and points balances in 21 currencies
- More than 58 million rows of traveler profile data
- More than 333 million account and credential records tied to email addresses
- Records on more than 22 million trips, Vrbo reservation and payment records, and nearly 500,000 guest communication records
- A workforce planning database
N0n also claims it obtained working credentials for Expedia’s big data platform, its source code repositories and a production cloud environment. Row counts are not the same as the number of affected people, since one customer can appear in many rows.
None of these claims have been independently verified. Expedia’s statement does not address the group’s figures, and the company has not said whether the incident it confirmed is the same one N0n describes.
The Qubole question
Expedia’s description closely matches a campaign disclosed on November 9 by cloud security firm Wiz and data security company Sentra. Between October 14 and 26, an attacker used access tied to big data platform Qubole to assume the cross-account AWS roles that customers had created for the vendor, then harvested stored secrets and copied out S3 buckets. BreachNews covered that campaign in detail in our report on the Qubole attacks.
Expedia is a former Qubole customer. Sentra found that at least one victim had stopped using Qubole a while ago but never removed the old access roles, which could still read nearly all of its source buckets. That is the kind of forgotten access that would let an attacker reach a former customer’s data through a vendor.
Still, Expedia has not named Qubole, and neither Wiz nor Sentra has publicly listed Expedia among the affected organizations. Qubole and its owner Idera had not issued any public statement at time of publication.
Who N0n is
N0n is a data extortion operation that surfaced in September 2026 and has listed more than 200 alleged victims since then. It claimed retailer Landmark Group around the same time that company confirmed a Shukran loyalty data breach, and this week it also listed Danish drugmaker LEO Pharma, which has not confirmed an incident. For more on how these groups pressure victims, see our explainer on data extortion.
What Expedia customers should watch for
Travel data is valuable to scammers because it lets them send messages that reference real trips, loyalty tiers and points. Until Expedia says what was affected, customers of its brands should:
- Treat unexpected emails, texts or calls about bookings, refunds or loyalty points with caution, even if they mention real trip details
- Sign in through the official app or website rather than links in messages
- Change reused passwords and turn on two-factor authentication where available
Our guides on checking a suspicious email safely and checking whether your email or password was exposed walk through the steps.
The travel sector has been hit repeatedly through its suppliers this year, including the Amadeus airline booking breach and the Booking.com reservation data breach.
BreachNews will update this story if Expedia names the vendor, confirms what data was taken or begins notifying customers.
