Expedia Says Hackers Came In Through Someone Else’s Door

Expedia Group has confirmed that attackers reached its systems through a compromised outside supplier, in what the company described as a supply chain attack that also hit other businesses. The acknowledgment, given to Skift on Thursday, came after cybersecurity sites spent the week reporting claims by an extortion group calling itself n0n that it had stolen Expedia data. Expedia said it contained the issue as soon as it became aware of it, is investigating with outside security experts, and that its platforms remain safe for travelers and partners to use.

What Expedia has not said is just as important. The company has not named the vendor, and it has not said what information was reached, how much, or whose. According to Cybernews, as cited by Hospitality.today, the group claims to hold 333.3 million Expedia consumer account records pairing account IDs and email addresses with password-like tokens, and is threatening to publish them. Those figures are the group’s own claims. No one has independently confirmed the scale of what was taken, and the group has not named any hotel or partner data.

Security researchers have described an attack that fits Expedia’s description. Firms Wiz and Sentra documented intrusions between October 14 and 26 involving Qubole, a cloud data platform Expedia once used. Attackers used access tied to Qubole to enter customers’ cloud environments and download data. Sentra found that former Qubole customers had never revoked the access they granted, leaving a way in long after the business relationships ended. Expedia has not confirmed that its breach is related, and the researchers have not named Expedia among the affected companies.

For travelers with an Expedia, Hotels.com or Vrbo account, sensible precautions cost little. Change your password, particularly if you reuse it elsewhere, and turn on two-step verification where offered. Be skeptical of emails or texts that quote real booking details and ask you to pay, confirm card information or click a link; criminals often use stolen travel data to make scams look convincing. If you have a trip coming up, check the reservation directly in the app or with the hotel rather than through a link in a message.

Sources: Skift, Hospitality.today