Huge data breach as major travel site is hacked - here's what you need to do now
An email on Monday revealed Australia's most popular travel booking website has suffered a data leak.
www.dailymail.co.ukHere’s the latest overview on Booking.com data breach news.
Direct answer
- Booking.com confirmed in mid-April 2026 that unauthorized parties may have accessed some customers’ reservation data, including names, email addresses, phone numbers, booking details, and information shared with accommodations. Several outlets reported that the company reset PINs for affected reservations and notified impacted guests, but the exact number of affected customers has not been disclosed.
Context and what’s known
- The breach prompted Booking.com to inform customers via email that “unauthorized third parties may have been able to access certain booking information,” and to take containment actions such as updating reservation PINs. Security communications also indicated that no financial payment data was compromised, though non-financial personal data could have been exposed.
- The incident appears to be part of a series of data-breach notifications the company has faced over the past decade, but each event’s scope and impact vary. Media coverage in April–May 2026 emphasized potential risks for phishing or targeted scams using leaked booking information.
What affected users might want to do
- Be vigilant for phishing attempts that reference legitimate Booking.com reservations or personal data. If you received a breach notification, monitor your email and Booking.com account for any unusual activity and consider enabling two-factor authentication if offered. Keep an eye on any communications from Booking.com for official guidance and follow their instructions to secure reservations (e.g., PIN resets).
- Review upcoming and past bookings for any discrepancies (dates, hotel names, or contact details) and update passwords or security settings on related email accounts. If you suspect fraud, report it to Booking.com and your financial institutions as appropriate.
Illustrative note
- Security incidents of this type underscore the importance of limiting personal data exposure in travel platforms and being cautious of scam attempts that leverage real booking data. While financial data wasn’t reported as compromised in these notices, personal identifiers can still be misused in targeted phishing.
Cited sources
- Booking.com data breach statements and affected data types (May 2026 context):[2][3]
- Interim reporting and containment actions (April 2026 reporting):[1][4]
- Media coverage and security guidance for travelers (April–May 2026):[8][9][10]
If you’d like, I can summarize the specific guidance from Booking.com’s notice you might have received, or help you set up a quick checklist to monitor for phishing and protect your accounts.