Expedia confirms hack through outside data vendor; hackers claim about 1 billion records

Expedia says attackers used a compromised third-party data platform provider to reach several companies' systems. It hasn't said what customer data was taken, and hasn't verified the hackers' claims.

In this brief: 3 sections 2 min read

- • Confirmed to Skift on November 12.
- • Attackers used the vendor's trusted access to reach systems at multiple companies.
- • Expedia says it contained the issue, is investigating with outside experts, and its platforms are safe to use.
- • The n0n group claims nearly 1 billion records, including 830 million+ loyalty rows and 333 million consumer account records with password-like tokens.
- • Expedia says it has not verified these figures.
- • Wiz and Sentra link a related October attack to a stolen Qubole vendor key; Expedia hasn't confirmed the vendor.
- • Change your Expedia, Hotels.com or Vrbo password if you reused it elsewhere.
- • Turn on two-step sign-in where offered.
- • Don't click links in unexpected messages about bookings, refunds or points; go to the app or site directly.

Read full analysis on skift.com

Useful?