A newly established Russian cyber extortion group has hit Expedia—the second-largest online travel agency in the world—claiming to have exposed nearly one billion traveler records and allegedly holding the company hostage.
Key Facts
Expedia Group confirmed Thursday evening to Skift that cyberhackers had breached its systems through a third-party data platform provider, in a supply chain cyberattack that also affected multiple companies.
The alleged haul includes more than 830 million loyalty program records, 58 million traveler profiles, and over 333 million consumer account and credential records.
The hack was first reported days earlier by several cybersecurity sites, after a newly established Russian extortion group known as n0n bragged that it had stolen Expedia data.
Expedia Group is “aware of a supply chain attack” in which attackers “compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies,” the company said in a statement shared with Forbes, noting it was investigating and “our platforms are safe to use for both travelers and partners.”
Key Background
The hacking group n0n, which SOCRadar described as “focusing on data theft and extortion without relying on traditional ransomware,” emerged in mid-September. The group’s modus operandi is to “gain unauthorized access to corporate networks to threaten public disclosure of stolen data, targeting entities across various sectors worldwide.” The n0n hackers claim to have stolen hundreds of millions of Expedia records containing customer data and has threatened to publish the data unless Expedia reaches a settlement. The group has also claimed to have gained access to source code after stealing live credentials for Expedia’s big data platform. The hack was carried out with a stolen vendor key from Qubole, a Google Cloud Platform (GCP) partner, according to reporting by cybersecurity companies Wiz and Sentra.
What Expedia Data Did Russian Cyberhackers Allegedly Access?
According to the cybersecurity news site Cybernews, n0n claims to have taken 830 million rows of data tied to 35 different loyalty programs, including customer emails, loyalty membership identifiers and points balances. Also taken: 58 million traveler profiles, including emails, account dates and home airports; 333 million consumer accounts pairing account IDs and emails with “password-like tokens”; nearly two and a half million credit card spending records “keyed by hashed customer email addresses”—meaning they were transformed into a string of scrambled, random-looking characters by a mathematical function; 72 million consumer matching records linked to customer and household identifiers; and half a million guest records containing accommodation details. “We take our travelers’ privacy extremely seriously,” Expedia’s statement said. “As soon as we became aware, we took action to contain the issue and began investigating alongside leading third-party security experts.”
Big Number
$14.7 billion. That’s how much total revenue Expedia Group reported in 2025. The travel behemoth operates a host of major travel brands, operating as Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire, and Trivago.
Want to see more Forbes articles on your feed? Tap here to make Forbes Australia a preferred source on Google.
Look back on the week that was with hand-picked articles from Australia and around the world. Sign up to the Forbes Australia newsletter here or become a member here.
