Expedia Group has been named in a reported cybersecurity incident. This page summarizes what is publicly known so far. Travel companies hold detailed information about the people who book with them, and they are responsible for protecting it and for telling people promptly when it may have been exposed.
Expedia Group’s Data Breach Investigation
Expedia Group was named on a dark web leak site in November 2026 by a group calling itself N0n, according to a law firm investigation notice and the tracking listing it cites. The group claimed responsibility for a cybersecurity incident involving the company and said it obtained roughly 58 million traveler profiles. Those claims have not been independently verified, and they are the only public account of the event so far.
According to the notice, the group claimed the data it holds may include loyalty program records, traveler profiles, account records containing password-like tokens, and booking records. Expedia Group has not publicly confirmed that an incident took place. It has not said how many people may be affected, when any unauthorized access began, how it was discovered, or whether the activity has been contained. The figure of roughly 58 million is the group’s own description of what it says it has, not a count of confirmed affected people.
The kinds of records described matter for readers. Traveler profiles can include names, email addresses, phone numbers, home addresses, dates of birth and saved passport or loyalty details, depending on what a person stored. Booking records can reveal where someone traveled, when, and with whom. Account records with password-like tokens raise a separate concern, because credentials can be reused or cracked and tried against other services. Which of these fields, if any, were actually taken has not been established.
Claims posted on leak sites follow a familiar pattern. Extortion groups often name a company publicly to pressure it into negotiating, sometimes well before any stolen files are published and sometimes without ever releasing proof. Some listings later prove accurate, others overstate what was taken, and companies frequently need a long forensic review before they notify anyone. Readers should treat early claims with caution while still taking sensible precautions.
For people who have booked travel, the most realistic near-term risk is targeted phishing. A message that references a real reservation, a real destination or a real loyalty account is far more convincing than a generic scam. Callers may pose as a hotel, airline or customer support agent and ask for payment details or a verification code. Travel itinerary details can also tell criminals when a home is likely to be empty, which is a reason to be careful about what you share publicly.
If account credentials were exposed, the risk extends beyond one company. Many people reuse the same password across several services, and attackers routinely try credentials from one breach against email, banking and shopping accounts. Changing the password on any account that shares it, and turning on two-factor authentication, reduces that risk regardless of whether this particular claim proves accurate.
Most states require organizations to notify affected people without unreasonable delay once a breach of personal information is confirmed, and several set specific outer deadlines. If Expedia Group determines that personal information was involved, it would be expected to send written notices describing what happened and what it is doing about it. Attorneys are examining whether the company took reasonable steps to protect the data it holds, and what options may be available to people whose information was exposed.
Until more is known, the safest approach is to watch for any notice from the company, keep records of any suspicious messages that reference it, and avoid sharing personal details with anyone who contacts you unexpectedly about the incident.
When Did This Breach Occur?
The claim was reportedly posted in November 2026. Expedia Group has not stated when any unauthorized access began, when it was discovered, or whether it has ended, so the timing of the underlying event is unknown for now. Readers will get a clearer picture if the company publishes a notice with dates.
What Information Was Breached?
The group claims to hold loyalty program records, traveler profiles, account records with password-like tokens, and booking records. These are the group’s claims, not confirmed findings. Expedia Group has not published a notice describing what information was involved, so it is not yet known which people, if any, had which kinds of data exposed.
What You Can Do
If you received a notice related to Expedia Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you have booked travel or hold an account with the company, change your password, avoid reusing it elsewhere, turn on two-factor authentication, and verify any message about a booking through the official website or app.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Expedia Group
If you have booked travel through Expedia Group, hold an account with the company, or receive a notice about this incident, you may have legal options for holding the company accountable for how it protected your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
