Expedia Group

Summary

Expedia Group confirmed that attackers reached its systems through a compromised third-party data platform provider in a supply chain attack affecting multiple companies. The company said it contained the issue upon discovery and is investigating with outside security experts, while its platforms remain safe for travelers and partners. The vendor, the data exposed, and the scale of the breach remain unconfirmed. An extortion group claimed to have stolen data and threatened publication unless a settlement was reached, though no specific ransom appeared on its dark-web page. Separately, researchers documented an earlier attack using credentials tied to a onetime vendor, noting that former customers had not revoked access permissions, though the company did not confirm whether its breach was related to that incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Expedia Group confirmed on Thursday, November 12, 2026, that attackers had reached its systems through a compromised third-party data platform provider in a supply chain cyberattack that affected multiple companies. The acknowledgment followed reports on cybersecurity sites earlier in the week alleging that an extortion group known as n0n had stolen Expedia data. In a statement to Skift, Expedia Group said it was aware of a supply chain attack reported by security researchers in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia. The company stated that it contained the issue as soon as it became aware and that it was investigating with outside security experts. Expedia also said its platforms remain safe for travelers and partners. The company did not identify the compromised vendor and did not disclose what information may have been exposed. The scale of the breach remains unconfirmed. According to Cybernews, the extortion group n0n threatened to publish what it claims is stolen Expedia data unless the company reached a settlement, though no specific ransom appeared on its dark-web page.

Separately, researchers at Wiz and Sentra documented an attack between October 14 and 26 involving the cloud data platform Qubole, which was once an Expedia vendor. In that incident, attackers used compromised credentials to enter multiple customers' cloud environments and download data. Sentra found that former Qubole customers never revoked the access permissions they had previously granted, leaving a way in long after the business relationships ended, and that those permissions could read nearly all of the data the attacker went after. Expedia did not confirm whether its breach is related to Qubole, and outside researchers have not publicly identified Expedia as one of the affected customers. The vendor involved in the Expedia incident, the data exposed, and the overall scale of the breach are all unconfirmed. Expedia is continuing its investigation with external security professionals while maintaining that its services remain operational for travelers and partners.

Sources

Sources available to members: 1 source.