(Photo Illustration by Mateusz Slodkowski/SOPA Images/LightRocket via Getty Images)
Popular travel site Booking.com has suffered a data breach in which hackers stole customer information, including reservation details.
On Sunday, users reported receiving emails from Booking.com, warning them that “unauthorized third parties may have been able to access certain booking information associated with your reservation.” The email suggests the hackers have already exploited customer information.
“We recently noticed suspicious activity affecting a number of reservations, and we immediately took action to contain the issue,” Booking.com wrote. “Based on the findings of our investigation to date, accessed information could include booking details and name(s), emails, addresses, phone numbers associated with the booking, and anything that you may have shared with the accommodation.”
Amsterdam-based Booking.com has now generated new PINs for customer reservations to prevent hackers from accessing them. The company is also clarifying that no users' physical addresses were accessed, suggesting address information for lodgings was compromised instead. "While some email addresses may have been accessed, no physical addresses were accessed," the company said.
Still, the incident risks exposing affected customers to potential phishing scams. A few Reddit users have already reported receiving scam messages on WhatsApp about their reservations. But we wonder whether the hackers may have been exploiting the breach for a while. The Australian Broadcasting Corporation reports that one Booking.com user received a phone call in December from someone who claimed to be a Booking.com agent but was actually an imposter out to steal his credit card details.
Asked for comment, Booking.com merely said, “We are dedicated to the security and data protection of our guests. We recently noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information. Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests.”
The company did not say how many users were affected or who might be responsible for the breach. In the meantime, some customers say they’ve received multiple emails about the breach, prompting them to reach out on social media to ask Booking.com if the emails are legitimate.
Booking.com describes itself as one of the leading providers for online travel, covering over "31 million total reported listings" for lodging.