Data leak at Voyage Privé - upcoming bookings exposed

On 16 February 2026, Voyage Privé — the Aix-en-Provence-based flash-sale travel platform — confirmed a data breach affecting customers who had bookings for upcoming trips. The company stated that its own systems were not directly breached; instead, the unauthorised access occurred through one of its partners between 3 and 5 February 2026.

The compromised reservation data concerned travellers with forthcoming bookings. Exposed information reportedly included:

• First and last names
• Country of residence
• Email addresses
• Phone numbers
• In some cases, passport numbers

The stolen data was quickly weaponised in a targeted phishing campaign. Attackers impersonated Voyage Privé customer service over WhatsApp, using accurate trip details to lend credibility to their messages and steering victims toward fraudulent domains — including one registered on 12 February 2026 behind Cloudflare-hosted infrastructure.

Voyage Privé acknowledged the incident publicly, notifying all affected customers through a dedicated communication, setting up a support contact and FAQ, and reporting the breach to France's data protection regulator, the CNIL. The number of affected customers was not disclosed and the investigation remained ongoing.