SEATTLE — Expedia Group has confirmed that attackers breached its systems through a third-party data platform provider, in a supply-chain attack that also affected other companies.
Expedia is “aware of a supply chain attack” in which attackers “compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies,” the company said in a statement shared with Forbes. It said it was investigating with outside security experts and that “our platforms are safe to use for both travelers and partners.”
What the hackers claim
A newly formed extortion group called n0n, which security firm SOCRadar says emerged in mid-September and focuses on data theft without deploying ransomware, has claimed responsibility. According to Forbes, citing Cybernews, the group says it took:
- about 830 million rows tied to 35 loyalty programmes, including emails, membership IDs and points balances;
- 58 million traveller profiles with emails, account dates and home airports;
- 333 million consumer account records pairing IDs and emails with “password-like tokens”;
- nearly 2.5 million card spending records keyed by hashed email addresses.
Expedia has not confirmed these figures, and they should be treated as the attackers’ claims. The group has threatened to publish the data unless Expedia reaches a settlement, and says it also obtained source code.
How they got in
Security companies Wiz and Sentra reported that the attack used a stolen vendor key from Qubole, a big-data platform and Google Cloud partner, to gain a trusted path into Expedia’s data environment, according to a source summary compiled by BaitAPhish. Qubole has not publicly commented on those reports.
The case fits a pattern seen across the industry this month. Uber and Notion have both disclosed customer data exposure linked to a breach at AI vendor Fireworks AI, World Cybersecurity News reported, underlining how a single supplier’s credentials can open doors at many companies.
Who is affected
Expedia Group runs Expedia, Hotels.com, Vrbo, Travelocity, Orbitz, Hotwire and Trivago, and reported $14.7 billion in revenue in 2025. Customers in Africa and the diaspora who book flights and hotels through these brands could be among those whose data was taken, if the claims are accurate.
What it means for African readers
The most likely immediate risk is phishing. Criminals holding real booking emails, loyalty numbers and home airports can send convincing fake “booking problem” or “refund” messages. Practical steps:
- Change your Expedia-group passwords and any reused passwords elsewhere, and turn on two-factor authentication.
- Check loyalty points balances for unexpected redemptions.
- Do not click payment or refund links in emails or WhatsApp messages; log in directly through the official app.
- Watch card statements, especially cards used for international travel bookings.
For African companies, the lesson is vendor risk: audit which third parties hold long-lived keys to your data and rotate them regularly.
What to watch
- Formal breach notifications from Expedia to regulators and customers, which would confirm the scope.
- Whether n0n publishes any data, and whether other companies hit through the same vendor come forward.
- Statements from Qubole or Google Cloud on how the vendor key was obtained.
