Expedia confirms breach via compromised third-party provider as extortion group n0n claims massive data theft (2026)

On 13 November 2026, Expedia Group — the Seattle-based online-travel company behind Expedia, Hotels.com and Vrbo — confirmed that attackers had gained access to its systems through a compromised third-party technology provider, after a newly established extortion group calling itself n0n listed the company on its leak site and claimed to hold hundreds of millions of records. Expedia described the event as a supply-chain compromise in which attackers abused a trusted vendor's access to reach the systems of several of the provider's customers, Expedia among them.

What Expedia has confirmed

Expedia said it became aware of the incident and contained the issue, and that it had brought in outside cybersecurity experts to investigate. The company stated that its platforms "remain safe for travellers and partners to use." Crucially, Expedia has not confirmed the amount or type of customer data exposed, the number of people affected, or whether the specific datasets described by n0n were actually taken, and it has not publicly attributed the attack to the group.

The attacker's claims

n0n, described as a relatively new data-extortion crew, claimed to have stolen more than 830 million loyalty-program rows, over 58 million traveller profiles and more than 333 million consumer account and credential records, plus hundreds of gigabytes of additional cloud data, and threatened to publish unless a settlement was reached. These figures are unverified and come solely from the attacker. As security researchers cautioned, database row counts are not the same as the number of affected travellers, since one person can appear across many records; there is also no confirmed evidence that payment-card details were exposed.

Why it matters

If even a fraction of n0n's claims hold up, this would rank among the largest exposures in the travel sector — but the more durable lesson is structural. A single compromised technology provider gave attackers a path into multiple downstream companies at once, a pattern that has driven many of the year's biggest breaches. For Expedia's customers, the immediate risk is targeted phishing and account-takeover attempts that lean on real booking and loyalty details; travellers should be wary of unexpected messages referencing their trips and enable multi-factor authentication where available.