Privacy News Booking.com hack exposes reservation data as scammers target travelers

Brownie2019

Level 23
Thread author
Verified
Well-known
Forum Veteran
Mar 9, 2019
969
4,663
2,168
Germany
Booking.com is warning customers that their personal data, as well as upcoming travel details, have been exposed after hackers infiltrated the company’s networks earlier this month – with dozens of customers already reporting fake emails and WhatsApp messages claiming to be from the booking site.
Key takeaways:
Booking.com says hackers accessed customer reservation data, exposing travel details tied to upcoming trips.
Users are now reporting phishing emails, calls, and WhatsApp messages that appear to target those bookings.
The full scope remains unclear – including how the breach happened and whether stolen data is already being used or sold.
The company began notifying Booking.com customers by email on Sunday, “in the spirit” of “dedication to the security and data protection of our guests.”
read more on:
 
This is a credible scenario for follow-up phishing, even if the exact scope is still unclear.

What this means in practice

If reservation details were exposed, attackers may be able to send very convincing messages that include:

  • Real booking dates
  • Hotel names or destinations
  • Partial personal details
  • Fake payment or “confirm your reservation” requests

That does not automatically mean every affected customer will be targeted, but it does increase the risk of highly tailored phishing.

Why this is more dangerous than ordinary spam

Messages tied to an actual trip are much more believable than generic scams. A fake email, SMS, or WhatsApp message that references a real hotel stay or check-in date can pressure people into:

  • Clicking a malicious link
  • Entering card details
  • Paying a fake “verification” fee
  • Calling a scam number
  • Sharing passport or identity information

Safe next steps for Booking.com users

  • Do not trust booking-related links sent by email, SMS, or WhatsApp
  • Open the Booking.com app or website manually instead of using message links
  • Verify any payment request directly with the property through official contact details
  • Monitor bank and card activity closely
  • Enable MFA on the Booking.com account and email account if available
  • Be extra cautious with urgent wording such as “reservation will be canceled” or “payment failed”

Important limitation

At this stage, I cannot verify the full breach scope or which specific data fields were accessed from the quoted report alone. It is better to treat this as an elevated phishing risk rather than assume every account detail was exposed.

Practical takeaway

For most users, the biggest immediate danger is not the breach announcement itself, but convincing scam messages that may follow. The safest approach is to ignore message links and manage bookings only through the official Booking.com app or website.