The n0n extortion group has published what it says is a slice of Expedia customer data, following a leak-site listing that claimed more than a terabyte of travel and loyalty records. Expedia has declined to comment and none of the claim has been independently confirmed, but UK travellers and businesses should prepare for the phishing that usually follows.
What happened
n0n, a data extortion crew that appeared in September 2026, has named Expedia Group as a victim on its dark web leak site. The listing is marked “not paid, exposed”, which suggests the group says it asked for money and was turned down. No ransom figure or deadline appeared in the text that monitoring services captured.
Reports disagree on timing. Australian outlet Cyber Daily, reporting on 12 November, dates the leak post to 3 November, while UK consultancy CyPro and tracker HookPhish say leak-site monitors first recorded it on 9 November.
At first the group offered no evidence. CyPro’s assessment on 9 November found no samples, no technical indicators, no Expedia security notice and no material incident filing with US regulators. According to Cyber Daily, that has now changed: n0n has put a compressed archive on the dark web, which the outlet describes as an extract of the larger haul rather than the whole set.
Expedia declined to comment when Cyber Daily asked about the claims. As of today the company has not publicly confirmed any breach, and nothing here should be read as proof that its systems were compromised.
The detail
Every figure below comes from the group itself. In its listing, n0n said it holds more than 830 million rows of loyalty programme data spread over 800 files. It says those rows include customer email addresses, member identifiers, points balances in 21 currencies and booking values across 35 named programmes. It also lists about 58 million traveller profile rows, more than 22 million journey records and nearly half a million guest messages.
HookPhish’s copy of the listing goes further. It includes an alleged archive of about 333 million account records pairing email addresses with what the group calls password-like tokens, and Vrbo reservation and payment records. It mentions a 174GB workforce planning backup dated 21 October 2026. The group also claims to hold live credentials for a big data platform, a source code token covering nearly 20,000 private repositories and a live production cloud environment. CyPro points out that none of this came with redacted credentials, logs or any other artefact that could be checked. It also notes that the 21 October date is attached to a backup file, so it is not evidence of when any intrusion happened.
According to Cyber Daily, the published extract spans 11 folders and several hundred thousand addresses, tied to logins, hotel stays, messages, traveller user IDs and points totals. The outlet checked addresses against Have I Been Pwned. Some had appeared in earlier breaches, but many had not, which counts slightly against the idea that the dump is just recycled old data. Date ranges in several files do, however, point to the material being at least partly historical.
The group’s background matters. Cyber Daily reports that n0n claimed 204 victims in October and has listed more than 100 in November, many shown only as numbers. Threat intelligence firm SOCRadar says it found an exposed staging server used by an n0n operator in September. It says every intrusion it documented relied on weak or stolen credentials, and that “no exploit payloads or CVE references were found in the operator’s files”. The routes it describes include FortiGate SSL-VPN credential stuffing routed via residential proxies, weak RDP and WinRM passwords, exposed AWS IAM keys and reused hosting provider sessions.
Why it matters for UK organisations
Expedia Group’s brands include Expedia, Hotels.com, Vrbo and Ebookers, all familiar to British consumers and to the many UK firms whose staff book business travel through them. If the claim turns out to be accurate, even partly, a dataset that links real names and email addresses to real trips, hotel stays and loyalty balances is ideal raw material for convincing fraud.
The timing makes this worse. UK households are booking Christmas and new year travel now, and a message that quotes a genuine booking reference or points balance is far more persuasive than a generic lure. Expect fake “your booking has a problem” emails, loyalty points “expiring” scams and calls that pretend to be from a hotel and ask for card details to “reconfirm” a stay.
If Expedia confirms that UK residents’ data was involved, UK GDPR requires a qualifying breach to be reported to the ICO within 72 hours of awareness, and individuals to be told where the risk is high.
Expert view
I treat leak-site claims with healthy suspicion. Extortion groups inflate numbers, recycle old dumps and sometimes name firms they never breached, and a terabyte-scale headline costs them nothing. CyPro is right that publication of a listing proves only that the listing exists. Publishing a sample shifts things a little, but an extract of possibly historical data could still have come from a third party, a partner integration or an older incident rather than Expedia’s own estate.
What worries me more is the method SOCRadar describes. When we test UK organisations, weak or reused credentials on internet-facing VPNs and remote access services are still among the most common ways in, and they need no zero-day at all. A group running credential attacks at scale, with an AI coding agent in its toolkit according to SOCRadar, can claim hundreds of victims a month, and some of those will be real.
What to do now
- Warn staff and customers. Brief travel bookers, finance and the service desk that booking-themed phishing is likely, and that changes should be checked in the official app, never via a link.
- Lock down travel and loyalty accounts. Make sure corporate travel accounts use unique passwords and multi-factor authentication, and review recent changes to contact details, saved payment methods and points balances.
- Close the doors n0n is said to use. Enforce MFA on every SSL-VPN, RDP and WinRM entry point, block legacy authentication and watch for bursts of failed logins from residential proxy ranges. This maps directly to the Cyber Essentials user access control and secure configuration controls.
- Hunt for exposed cloud keys. Scan repositories and CI pipelines for AWS IAM access keys, rotate any long-lived keys and move to short-lived, role-based credentials wherever possible.
- Check your exposure. Use Have I Been Pwned domain monitoring to spot corporate addresses appearing in new dumps, and force password resets where they do.
- Prepare the paperwork. Identify which contracts with travel providers involve personal data, so your data protection officer can judge quickly whether any onward ICO or individual notification applies if Expedia confirms an incident.
Bottom line
This is still an unproven claim from a noisy, fast-growing extortion group, and Expedia has said nothing. The published extract, and email addresses that do not appear in earlier breach data, make it harder to dismiss out of hand, though. UK organisations should not wait for confirmation: harden remote access against credential attacks now and warn travellers that convincing booking scams are likely in the run-up to Christmas.
