BCD Travel USA LLC, a corporate travel booking company based in Atlanta, Georgia, has begun notifying people that an unauthorized actor copied files from one of its enterprise user accounts. The company reported the incident to the New Hampshire Attorney General on October 27, 2026.
People who travel on business often hand over passport details to a company they never chose themselves, because their employer did. Here is what BCD Travel says happened, and what it has not said.
BCD Travel’s Data Breach Investigation
BCD Travel says it provides corporate travel booking services and was given information about travelers in the course of that work. That means many of the people receiving these letters did not pick BCD Travel themselves. Their employer or another organization arranged the travel and passed their details along.
According to the notice, BCD Travel became aware of suspicious activity related to an enterprise user account on or about May 26, 2026. The company says it acted immediately to isolate the account and began an investigation with the help of outside cybersecurity and data privacy specialists. That investigation determined that an unauthorized actor gained access to the account between May 22, 2026 and May 26, 2026, and copied certain files that were available there.
Finding out who was affected took months. BCD Travel says it carried out a detailed and time-intensive review of the impacted data to work out what the files contained and which individuals the data related to. The company describes that review as only recently complete when it began sending notices.
The filing with the New Hampshire Attorney General adds a detail about how the notice list grew. When BCD Travel’s mailing vendor checked the notification addresses against the U.S. Postal Service’s National Change of Address database, the results, received on October 23, 2026, showed for the first time that one person in the notice population now lived in New Hampshire. BCD Travel began mailing written notice to that person on or about October 26, 2026. The filing reports one New Hampshire resident. It does not state how many people were affected overall, and no total has been published, so this page does not give one.
For the New Hampshire resident, the information that could have been accessed included a name and a passport. The individual notice letter is a template, and in the copy filed with the state, the line listing the data elements for each recipient is still a blank merge field. The company has not publicly stated a universal list of the information involved, so the exact items will differ from person to person.
BCD Travel says it notified federal law enforcement and is working to put additional safeguards and staff training in place. It is offering credit monitoring and identity theft protection through Experian IdentityWorks for 12 months at no cost, and says that people have to enroll themselves, since the company cannot do it on their behalf.
Passport details deserve particular attention. A passport number tied to a name, and possibly a date of birth and other travel details, can support identity fraud, fake document applications, and highly convincing impersonation scams. Unlike a credit card number, a passport number cannot simply be canceled and reissued overnight, and travelers may not notice misuse until something goes wrong at a border, a bank, or an airline.
Travel records carry another kind of risk. Itineraries and traveler profiles show where someone will be and when, and that information can be used to craft believable phishing messages about bookings, changes, or refunds. People who receive an unexpected message that mentions a trip should check it independently rather than clicking a link or calling a number in the message.
The notice does not explain how the unauthorized actor obtained access to the enterprise account, what kinds of files were stored there, or whether the files have been published or misused. These open questions are part of what makes it hard for affected people to gauge their own risk, and they are the kind of questions that data breach claims often examine, including whether an organization used reasonable security measures to protect the information entrusted to it.
Anyone who receives this notice should read it carefully, keep it for their records, and enroll in the offered monitoring. People affected by an incident like this may also have legal options. A class action can allow many affected people to bring claims together, which can be a practical route when each person’s losses are modest but the exposure of sensitive data is shared across a group.
When Did This Breach Occur?
According to the notice, BCD Travel became aware of suspicious activity on or about May 26, 2026, and found that an unauthorized actor had access to the enterprise user account between May 22, 2026 and May 26, 2026.
The company then spent months reviewing the affected files. Written notice began on or about October 26, 2026, and the company reported to the New Hampshire Attorney General on October 27, 2026.
What Information Was Breached?
The notice says the information that could have been accessed includes a name and a passport for the New Hampshire resident. The data elements differ from person to person, and the sample letter filed with the state leaves that list as a blank template field.
Because passport details and travel information can be used for identity fraud and targeted scams, treat any unexpected message that mentions a booking or trip with caution.
What You Can Do
If you received a notice from BCD Travel, consider these steps:
- Read your notice carefully and keep it with your records.
- Enroll in the 12 months of complimentary Experian IdentityWorks coverage using the instructions in your letter.
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com and look for accounts you do not recognize.
- Consider a free fraud alert or security freeze on your credit file with each of the three credit bureaus.
- If your passport number was involved, watch for suspicious activity tied to it and consider contacting the issuing authority if you suspect misuse.
- Be cautious with unexpected messages about bookings, changes, or refunds, and verify them directly with the airline, hotel, or your employer’s travel desk.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against BCD Travel
People whose passport details and other personal information were exposed in a data security incident may be able to bring claims against the organization responsible, particularly if reasonable security steps were not taken.
If you were notified that your information was involved in the BCD Travel incident, it may be worth speaking with a lawyer about your options. Keep your notice and records of any fraud, or of the time and money you spent dealing with it.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
