Booking.com warns of possible data breach

The company said it had detected suspicious activity affecting a number of reservations and had taken steps to contain the incident and strengthen security measures.

According to the platform, the data potentially exposed may include names, email addresses, phone numbers, booking details, as well as information shared with accommodation providers. At the same time, the company stressed that users’ financial data was not compromised within its systems.

The exact number of affected users has not been disclosed.

Cybersecurity researchers note that the attacks are multi-stage and primarily aimed at financial fraud. In the initial phase, attackers send emails impersonating Booking.com to hotel staff, often referencing complaints or booking inquiries, and redirect them to fake login pages to steal credentials.

After gaining access to partner accounts, the attackers use real booking data to target customers. In particular, users may receive messages requesting payment confirmation, including via messaging apps, allowing fraudsters to obtain banking details.

Earlier Qazinform News Agency reported that over 10,000 European hotels filed a lawsuit against Booking.com over its pricing policies.