Extortion Group Claims Theft of Nearly One Billion Expedia Traveler Records
November 14, 2026 
Russian extortion group n0n claims to have stolen nearly one billion Expedia traveler records through a compromised third-party provider.
A newly formed Russian cyber extortion group called n0n claims it has hit Expedia, the world’s second-largest online travel agency, and taken data on nearly one billion travelers. Expedia confirmed to Skift on Thursday that attackers had breached its systems through a third-party data platform provider in a supply chain attack that also affected other companies.
“Expedia Group confirmed Thursday that attackers reached its systems through a compromised third-party data platform provider, in a supply chain cyberattack that also affected multiple companies.” reported the website Skift. “Acknowledgment came after several cybersecurity sites reported this week on allegations by an extortion group known as n0n that it had stolen Expedia data. “
Expedia has not confirmed the figures reported by n0n and says its investigation is still ongoing. The company confirmed it was affected by a supply chain attack in which hackers compromised a third-party data platform provider and used its trusted access to reach several companies’ systems. Expedia says its platforms remain safe for both travelers and business partners.
The amount of data allegedly stolen is substantial. N0n claims to have obtained more than 830 million loyalty program records from 35 programs, including customer email addresses, membership IDs, and points balances.
“The alleged haul includes more than 830 million loyalty program records, 58 million traveler profiles, and over 333 million consumer account and credential records.” Forbes reports. “The hack was first reported days earlier by several cybersecurity companies, after a newly established Russian extortion group known as n0n bragged that it had stolen Expedia data.”
The group also claims to have stolen 58 million traveler profiles containing home airports and account information, 333 million consumer account records containing password-like tokens, nearly 2.5 million credit card spending records linked to hashed email addresses, 72 million consumer matching records, and 500,000 guest records containing accommodation details.
Cybersecurity firms Wiz and Sentra say the attack was carried out using a stolen vendor key from Qubole, a Google Cloud Platform partner. That access gave the attackers a trusted path into Expedia’s big data platform. N0n also claims to have taken source code through live credentials it captured the same way.
N0n emerged in mid-September and, according to SOCRadar, focuses on data theft and extortion without using ransomware. It operates with a specific pressure tactic: each victim appears on its dark web leak site only as a numbered company with a countdown timer labeled “pending exposure”, and “the group only exposes a company by name if it doesn’t pay.” The site claims 224 attacks since September.
Ransom negotiator Alex Waintraub, who is not working on the Expedia case, told Forbes that n0n’s claims appear to be a way to pressure victims into paying. He said the group’s approach is unusual because it lists victims as “Company 89” or “Company 90” without revealing their names until the countdown ends and no deal is reached. If this is how the group operates, Expedia’s decision to publicly confirm the breach is an unusual move that could weaken the hackers’ pressure tactics.
Expedia reported $14.7 billion in revenue in 2025 and operates Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire, and Trivago alongside its main brand. If you have an Expedia account, a Hotels.com account or a Vrbo account, all three may draw from the same data pool.
Travelers should change the passwords for their Expedia accounts using a trusted device and avoid reusing the same passwords on other services. Although the stolen password-like tokens are hashed, attackers may still be able to crack them. The stolen loyalty program data also gives hackers access to customer email addresses and points balances, which they could use to create convincing phishing messages.
Expedia says it took steps to contain the attack as soon as it became aware of it and brought in external cybersecurity experts to investigate.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Expedia)
