Booking.com Confirms Data Breach, Warns of Reservation Hijacking and Targeted Attacks
Booking.com confirmed a data breach where unauthorized third parties gained access to certain customer reservation data. Experts warned on April 25, 2026, that the leaked information could be used for booking fraud and targeted phishing attacks, known as 'Reservation Hijacking.' Initial notifications to customers began around April 13, 2026, stating that booking information, including personal details, might have been exposed. The platform did not disclose the exact number of affected customers or regions.
Signal context
First seen: Apr 25, 2026
Last updated: Jun 29, 2026
Status: Public signal
Key points
- Confirmation/Warning date: April 25, 2026.
- Initial notifications: April 13, 2026.
- Affected data: Reservation data, including names, emails, phone numbers, and potentially other personal details. Financial information was reportedly not compromised.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Information
Likely country: Location not provided
Watch phishing, executive impersonation and account-takeover exposure.
- Source type: outside the affected organization
Impact area: Confidentiality
Likely asset: User or customer data
- 23 signals in the same sector
- 88 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
Data Breach Roundup (Apr 10-16, 2026) - Privacy Guideshttps://www.privacyguides.org/news/2026/04/17/data-breach-roundup-apr-10-16-2026/Public source from privacyguides.org.
Cyber News Roundup – April 17th 2026 - Integrity360https://www.integrity360.com/cyber-news-roundup-april-17th-2026Public source from integrity360.com.
New Booking.com data breach forces reservation PIN resets - BleepingComputerhttps://www.bleepingcomputer.com/news/security/new-bookingcom-data-breach-forces-reservation-pin-resets/Public source from bleepingcomputer.com.
Booking.com Says Hackers Accessed User Information - SecurityWeekhttps://www.securityweek.com/booking-com-says-hackers-accessed-user-information/Public source from securityweek.com.
Daily Breach Intelligence 13 April 2026 - Booking.com data breach; Rockstar Games supply chain hack; Adobe Acrobat zero-day & more - All Articles - CISO Platformhttps://cisoplatform.com/articles/daily-breach-intelligence-13-april-2026-booking-com-data-breach-rockstar-games-supply-chain-hack-adobe-acrobat-zero-day-morePublic source from cisoplatform.com.
April 2026 Data Breaches: 15+ Major Incidents & Latest Updates - SharkStrikerhttps://sharkstriker.com/blog/april-2026-data-breaches/Public source from sharkstriker.com.
Booking.com-Datenleck 2026 - Vorsicht vor Reservierungs-Hijacks und gezielten Angriffen.https://tuta.com/de/blog/booking-com-hacked-user-data-exposedPublic source from tuta.com.
Data Breach Tracker 2026: Latest Breaches and Settlements - Redfox Cybersecurityhttps://www.redfoxsec.com/blog/data-breach-tracker-2026-latest-breaches-settlementsPublic source from redfoxsec.com.
10 Data Breaches to Know About (April 2026) - Security Magazinehttps://www.securitymagazine.com/articles/102282-10-data-breaches-to-know-about-april-2026Public source from securitymagazine.com.
Related signals
Grouped by why the signal is relevant.
French government messaging platform Tchap breached via compromised user account
DINUM, the French government's digital affairs directorate, warned that hackers breached Tchap, France's encrypted messaging platform for public sector workers, using a compromised user account. The incident was detected by ANSSI, after which the affected account was blocked and an investigation launched into what conversations and data may have been accessed. DINUM has notified France's data protection authority, CNIL, due to the potential exposure of personal data. A threat actor claimed responsibility, alleging they used social engineering to access an education-related account and scrape messages, account information, and files, including 13.5GB of data from the French tax authority and other civil servants.
French Government Messaging Service Tchap Breached via Hijacked Account
Tchap, the French government's encrypted messaging platform, suffered a data breach after a user account was compromised through social engineering. Attackers reportedly scraped 13.5GB of data, including 560,000 messages and information on over 73,000 accounts, such as email addresses, organization details, meeting links, and account and device metadata, from the French tax authority and other civil servants. DINUM, the digital affairs directorate of the French government, issued a warning about the incident. The breach was disclosed on June 12, 2026.
Malicious 'Edgecution' Extension Exploits Microsoft Edge Native Messaging for Ransomware Deployment
Security researchers reported on June 25, 2026, the discovery of a new malware campaign dubbed 'Edgecution,' which utilizes a malicious Microsoft Edge extension to deploy ransomware and a Python-based backdoor. The extension abuses the Native Messaging API to escape the browser sandbox and establish a persistent system-level executor. Attackers are reportedly using Microsoft Teams for social engineering, directing victims to fake 'Outlook Updates Management Console' websites to trick them into installing the malicious extension. This campaign is believed to be operated by an Initial Access Broker (IAB) linked to the 'Payout Kings' ransomware operation.
Xsolis Data Breach Exposes 1.4 Million Patient Records Across Eight Health Systems
A targeted phishing attack on healthcare AI company Xsolis exposed the data of at least 1.4 million patients across eight U.S. health systems, including Mayo Clinic. The breach, which occurred on January 20, 2026, was reported to HHS on June 5, and widely reported on July 2, 2026. Exposed data included Social Security numbers, health insurance details, and medical treatment records.
CTIVD: AIVD en MIVD verwerken persoonsgegevens in bulkdata onrechtmatig
The Dutch intelligence services, AIVD and MIVD, have unlawfully processed personal data in bulk datasets, according to a ruling by the Committee for the Supervision of the Intelligence and Security Services (CTIVD). The report, published on July 1, 2026, states that groups of employees had unauthorized access to personal data, and large quantities of data were stored for too long. The bulk datasets, sometimes containing millions of records, include names, phone numbers, location data, social media data, and communication content, sourced from government agencies, commercially available datasets, or stolen datasets offered by criminals. The CTIVD has issued thirteen recommendations to improve the situation.
STNet, Inc. Affected by KDDI Corporation Data Breach
STNet, Inc., a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. STNet customers' email addresses and passwords may have been compromised.