Hackers say they hold 333 million Expedia records after a breach through an outside vendor

Expedia Group confirmed that attackers reached its systems through a compromised third-party data platform, without naming the vendor or saying what data was involved

by Markus Busch

Driving the news. On Thursday, Expedia Group confirmed to Skift that attackers had reached its systems through an outside supplier. "We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group," the company said. It added that its platforms "remain safe to use for both travelers and partners."

The statement came after cybersecurity sites reported this week on claims by an extortion group calling itself n0n. According to Cybernews, the group says it holds 333.3 million Expedia consumer account records, pairing account IDs and email addresses with password-like tokens, and threatens to publish them unless Expedia reaches a settlement.

What Expedia hasn't said. It didn't name the vendor. It didn't say what information was reached, how much, or whose. For a hotel, that last question is the one that matters. Expedia holds your guests' names and stay details, your rates and your property's own records. Nothing in the statement says whether any of it was involved, or that it wasn't.

How the matching attack worked. Two security firms, Wiz and Sentra, published accounts on November 9 of an attack through Qubole, a cloud data platform Expedia once used. Between October 14 and 26, an attacker used access tied to Qubole to enter its customers' cloud systems and download their data, in some cases whole storage folders in a single session. Sentra counts more than a dozen organizations hit.

The way in was not a break-in. Companies had given Qubole standing access to their systems so it could do its job. When they stopped using it, much of that access stayed. "Qubole roles were still in place long after companies had stopped using Qubole, and those roles could read nearly all of the data the attacker went after," Sentra wrote. The access had sat unused since spring before the attacker picked it up.

The catch. Expedia has not said the vendor was Qubole, and neither research firm names Expedia among the companies affected. Skift reported only that Expedia's description of the attack is consistent with the Qubole case. The extortion group's figures are its own claims, it has named no hotel or partner data, and the scale of what was taken from anyone is unconfirmed.

What it means for hotels. Ask your Expedia market manager two things: whether any partner or guest data was involved, and whether Expedia will tell partners directly when it knows. If your guests start receiving messages that quote their Expedia booking, you will hear about it at the front desk before you hear it from Expedia. We have written about that pattern before.

Then look at your own doors. Every hotel has handed out keys over the years: logins to the Expedia and Booking.com extranets, connections from a channel manager you replaced, access for a revenue tool you cancelled, an agency that ran your ads two years ago, the revenue manager who left in spring. Each one still works until somebody switches it off.

This week, open the user list in each extranet, your property system and your booking engine. Remove every person and every company you no longer work with.

Read also: The Booking.com cost that isn't commission

Enjoying this analysis? Hospitality.today delivers daily insights on hotel distribution, AI trends, and travel commerce — straight to your inbox. Subscribe for free at Hospitality.today →