Booking.com Data Breach 2026:
What You Need to Know
On 13 April 2026, Booking.com confirmed that unauthorised third parties accessed guest data through a partner system. Names, emails, phone numbers, home addresses and reservation details were exposed. Here is what happened and steps you can take.
Your personal risk from this breach
Sign in or create a free account to see your personalised risk score.
What Happened
How the Booking.com Breach Unfolded
Early 2026
Threat actors tracked by Microsoft as Storm-1865 ran a ClickFix phishing campaign against Booking.com hotel partners, tricking hotel employees into installing malware disguised as a computer fix. The attackers used the compromised partner accounts to access guest reservation data through legitimate channels.
13 April 2026
Booking.com publicly confirmed that unauthorised third parties accessed guest data via compromised hotel partners and began notifying affected travellers and data protection authorities. The company stated that payment-card primary account numbers (PANs) and financial information were not exposed.
Mid-late April 2026
Independent researchers and outlets including TechCrunch, Help Net Security and Malwarebytes Labs reported the stolen data already in active use for reservation-hijack scams: criminals contacting guests with real booking details (property, dates, confirmation numbers) and asking them to “verify” a card or pay an outstanding balance via a malicious link.
Affected travellers received an email with the subject line referencing "Important security information about your Booking.com account".
Source: Booking.com Security & Trust
What Was Exposed
Personal Data Leaked in the Breach
According to Booking.com, the affected partner system held guest contact and reservation information. Payment-card primary account numbers (PANs) were not stored in the affected system.
| Data Type | Risk Level | Who Was Affected |
|---|---|---|
| Full name | High | Affected Booking.com guests with active reservations |
| Email address | High | Affected Booking.com guests with active reservations |
| Phone number | High | Affected Booking.com guests with active reservations |
| Home/billing address | High | Subset of affected guests (where stored at booking) |
| Reservation details | Medium | Affected guests, including check-in/out dates, property names and confirmation numbers |
| Loyalty / Genius status | Low | Subset of affected guests with Genius accounts |
Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Reservation context (dates, property, confirmation number) is what makes this breach particularly useful for travel-themed phishing.
✅ Confirmed NOT Exposed
Booking.com has stated that full credit-card numbers (PANs), CVV/CVC values and account passwords were not stored in the affected system. Booking.com account login was not compromised.
Company Response
What Booking.com Did
“We are committed to the security of our customers' data. We have notified the relevant authorities and are contacting affected guests directly.”
Actions Taken by Booking.com
- Isolated the affected partner system on detection
- Notified data protection authorities in jurisdictions where affected guests reside
- Began emailing affected travellers with details of the specific fields exposed
- Engaged third-party cyber forensics specialists to review partner access controls
- Published guidance for guests on identifying phishing impersonating Booking.com
What Now?
Steps You Can Take After the Booking.com Breach
The biggest risk from this breach is targeted phishing using your real reservation details. The combination of name email phone number and booking context gives scammers everything they need to impersonate a property or Booking.com support convincingly.
Booking.com & Travel Accounts
Your reservation details were exposed. Other travel and accommodation accounts may use the same email.
Secure your Booking.com account
~5 minReview other travel and loyalty accounts
Email and Digital Identity
Your email is the key to your digital identity. Securing it is a sensible first step.
Strengthen email security
~5 minUnderstand your full account exposure
Identity Protection
Name + address + phone is enough for travel-themed identity fraud.
Watch your card statements closely
~10 minSet a SIM lock or port-out PIN
~10 minMonitoring and Reporting
Resources for breach response in Australia and the EU.
Stay alert for 'property contacted me' phishing
Not sure which of your accounts are affected?
In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.
Are You Still at Risk?
Compound Risk: Booking.com Plus Other Travel Breaches
Booking.com is the latest in a string of travel-industry incidents. If your email also appeared in earlier travel breaches, the cumulative profile builds a much richer target for fraud.
Why this matters
The Booking.com breach exposed names, emails, dates, addresses and reservation details. Paired with passport numbers from the Eurail breach, frequent-flyer details from Qantas, or hotel-stay history from Marriott, an attacker can construct a surprisingly complete travel identity that defeats common identity-verification questions.
- Eurail (2026)300K+ records - passport numbers, names, dates of birth
- Qantas (2025)5.7M records - name, email, date of birth, phone
- Marriott / Starwood (2018)500M records - name, address, passport numbers
- Optus (2022)9.8M records - passport, licence, Medicare numbers
If your email appears in two or more travel breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.
Frequently Asked Questions
Booking.com Breach FAQ
Sources
- TechCrunch: "Booking.com confirms hackers accessed customers' data" (13 Apr 2026)
- Help Net Security: Booking.com data breach: Customer reservation data exposed
- Malwarebytes Labs: Booking.com breach gives scammers what they need to target guests
- Booking.com: Security and trust at Booking.com
- European Data Protection Board guidance on personal data breaches
- OAIC: Notifiable Data Breaches Scheme (Australia)
- OAIC: What is personal information? (Privacy Act 1988 categories)
- OAIC: Australian Privacy Principles
Other Major Australian Data Breaches
Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.
NYC Health + Hospitals Data Breach 2026
~1.8M records exposed
Australian Courts Data Breach 2026
Thousands of files records exposed
youX Data Breach 2026
~444K records exposed
Prosura Data Breach 2026
300K-500K records exposed
Canvas (Instructure) Data Breach 2026
~275M (claimed) records exposed
McGraw Hill Data Breach 2026
13.5M records exposed
Crunchyroll Data Breach 2026
Undisclosed records exposed
Eurail Data Breach 2026
300K+ records exposed
Basic-Fit Data Breach 2026
1M records exposed
Under Armour Data Breach 2025
72M records exposed
Salesforce (ShinyHunters) Data Breach 2025
~1B records exposed
Allianz Life Data Breach 2025
2.8M records exposed
Workday Data Breach 2025
Undisclosed records exposed
Western Sydney University Data Breach 2025
10K records exposed
Genea Fertility Data Breach 2025
940K records exposed
DeepSeek Data Breach 2025
1M records exposed
Tangerine Telecom Data Breach 2024
232K records exposed
Australian Clinical Labs Data Breach 2022
223K records exposed
Qantas Data Breach 2025
5.7M records exposed
Optus Data Breach 2022
9.8M records exposed
Medibank Data Breach 2022
9.7M records exposed
Latitude Financial Data Breach 2023
14M records exposed
MyDeal (Woolworths) Data Breach 2022
2.2M records exposed
Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Booking.com or its parent Booking Holdings Inc. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.