Booking.com reservation data accessed; affected booking PINs reset
Unauthorised parties accessed some Booking.com guests’ reservation and contact information. Booking.com reset affected booking PINs and said the incident was contained. Verify payment requests independently, even when they include real booking details.
Open Booking.com directly to review your reservations and contact support about any PIN-reset notice you cannot verify. Confirm unexpected payment requests using contact details from your original booking confirmation, even if the message knows your travel details. If you entered card details on a suspicious page, contact your bank immediately.
What’s happening
Booking.com confirmed on 13 April that unauthorised parties had accessed some guests’ reservation information. Potentially exposed information included names, email addresses, phone numbers, booking details and information shared with accommodation providers. Initial notifications also mentioned addresses, but Booking.com subsequently told Heise that physical and postal addresses were not accessed. The company said customer accounts and financial or payment information were unaffected. It reported containing the incident, resetting affected reservation PINs and notifying guests, including people with past bookings. The access method and number of affected guests remain undisclosed in the sources reviewed. Reports of reservation-related scams were not conclusively linked to this breach. In June, the UK privacy regulator withheld information requested about the incident. As at 3 November, no later public resolution was found; the company’s containment statement does not establish that previously accessed information can no longer be misused.
- What
- Breach
- Affects
- Booking.com guest reservations
- Fixed in
- Nothing to patch
- Since
- 13 Apr 2026
- Closed
- 22 June 2026
Timeline
- Update
The UK Information Commissioner’s Office recorded an information request about the April breach, covering affected numbers, notification timing and regulatory assessments. Its published outcome was that information was withheld.
- Vendor revised
Booking.com told Heise that physical and postal addresses had not been accessed, narrowing earlier notifications that listed addresses among potentially exposed information. It still did not explain how the access occurred.
- Update
Booking.com told SecurityWeek the incident was fully contained and affected customers had been informed. It said customer accounts had not been breached and financial or payment information had not been accessed.
- Made publicNothing to patch
Booking.com confirmed unauthorised access to some guests’ reservation information. Affected guests had received email warnings and replacement PINs for past and current reservations; the number affected was not disclosed.
Sources
- Booking.com Says Hackers Accessed User Information — includes Booking.com’s containment statementSecurityWeek · 13 Apr 2026
- New Booking.com data breach forces reservation PIN resetsBleepingComputer · 13 Apr 2026
- Booking.com: Unauthorized access by criminals discovered — includes Booking.com’s clarificationHeise · 14 Apr 2026
- IC-520323-V4P7Information Commissioner’s Office · 22 June 2026
- When Hotel Scams Know Your Booking: 350 Compromised Accommodations Across 50 CountriesGen Threat Labs · 28 May 2026