{"id":"booking-reservation-data-breach-apr-2026","category":"breach","status":"closed","title":"Booking.com reservation data accessed; affected booking PINs reset","tldr":"Unauthorised parties accessed some Booking.com guests’ reservation and contact information. Booking.com reset affected booking PINs and said the incident was contained. Verify payment requests independently, even when they include real booking details.","summary":"Booking.com confirmed on 13 April that unauthorised parties had accessed some guests’ reservation information. Potentially exposed information included names, email addresses, phone numbers, booking details and information shared with accommodation providers. Initial notifications also mentioned addresses, but Booking.com subsequently told Heise that physical and postal addresses were not accessed. The company said customer accounts and financial or payment information were unaffected. It reported containing the incident, resetting affected reservation PINs and notifying guests, including people with past bookings. The access method and number of affected guests remain undisclosed in the sources reviewed. Reports of reservation-related scams were not conclusively linked to this breach. In June, the UK privacy regulator withheld information requested about the incident. As at 3 November, no later public resolution was found; the company’s containment statement does not establish that previously accessed information can no longer be misused.","action":"Open Booking.com directly to review your reservations and contact support about any PIN-reset notice you cannot verify. Confirm unexpected payment requests using contact details from your original booking confirmation, even if the message knows your travel details. If you entered card details on a suspicious page, contact your bank immediately.","product":"Booking.com guest reservations","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["booking-com","travel","data-breach","personal-data","phishing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Booking.com Says Hackers Accessed User Information — includes Booking.com’s containment statement","url":"https://www.securityweek.com/booking-com-says-hackers-accessed-user-information/","by":"SecurityWeek","date":"2026-04-13"},{"kind":"news","title":"New Booking.com data breach forces reservation PIN resets","url":"https://www.bleepingcomputer.com/news/security/new-bookingcom-data-breach-forces-reservation-pin-resets/amp/","by":"BleepingComputer","date":"2026-04-13"},{"kind":"news","title":"Booking.com: Unauthorized access by criminals discovered — includes Booking.com’s clarification","url":"https://www.heise.de/en/news/Booking-com-Unauthorized-access-by-criminals-discovered-11257026.html","by":"Heise","date":"2026-04-14"},{"kind":"post","title":"IC-520323-V4P7","url":"https://cy.ico.org.uk/about-the-ico/our-information/disclosure-log/2026/06/ic-520323-v4p7/","by":"Information Commissioner’s Office","date":"2026-06-22"},{"kind":"research","title":"When Hotel Scams Know Your Booking: 350 Compromised Accommodations Across 50 Countries","url":"https://www.gendigital.com/blog/insights/research/reservation-hijack-scams-target-travelers","by":"Gen Threat Labs","date":"2026-05-28"}],"started":"2026-04-13","closed":"2026-06-22","created":"2026-11-03T20:48:06.352Z","updated":"2026-11-03T20:48:06.352Z","cve_notes":[],"timeline":[{"at":"2026-06-22","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The UK Information Commissioner’s Office recorded an information request about the April breach, covering affected numbers, notification timing and regulatory assessments. Its published outcome was that information was withheld.","url":"https://cy.ico.org.uk/about-the-ico/our-information/disclosure-log/2026/06/ic-520323-v4p7/","by":"Information Commissioner’s Office","patch":null},{"at":"2026-04-14","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"Booking.com told Heise that physical and postal addresses had not been accessed, narrowing earlier notifications that listed addresses among potentially exposed information. It still did not explain how the access occurred.","url":"https://www.heise.de/en/news/Booking-com-Unauthorized-access-by-criminals-discovered-11257026.html","by":"Heise","patch":null},{"at":"2026-04-13","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Booking.com told SecurityWeek the incident was fully contained and affected customers had been informed. It said customer accounts had not been breached and financial or payment information had not been accessed.","url":"https://www.securityweek.com/booking-com-says-hackers-accessed-user-information/","by":"SecurityWeek","patch":null},{"at":"2026-04-13","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Booking.com confirmed unauthorised access to some guests’ reservation information. Affected guests had received email warnings and replacement PINs for past and current reservations; the number affected was not disclosed.","url":"https://www.bleepingcomputer.com/news/security/new-bookingcom-data-breach-forces-reservation-pin-resets/amp/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/booking-reservation-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=booking-reservation-data-breach-apr-2026"}