Security notice
Do you still let old vendors reach your customer data? Expedia says attackers got in through a third-party data platform, and has not said what was taken.
On November 12, 2026, Expedia Group confirmed to Skift that attackers reached its systems through a compromised third-party data platform provider, in a supply chain attack that also affected other companies. In a statement quoted by Skift, the company said attackers "compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group." It said it contained the issue as soon as it became aware, is investigating with outside security experts, and that its platforms "remain safe to use for both travelers and partners." The company has not named the vendor, and it has not said what information, if any, was taken, or how many people may be involved. An extortion group calling itself n0n has claimed a large haul of Expedia customer data; those claims have not been independently verified, and Expedia has not confirmed them. This is not a named software flaw, so there is no CVE or patch to install. If you run a store or booking site that shares data with vendors, this is a reminder to remove access you no longer need and to rotate keys. (Expedia Group, via Skift, Nov 12)
What happened
- Confirmed November 12. Expedia Group told Skift that attackers reached its systems through a compromised third-party data platform provider, as part of a supply chain attack that also hit other companies. The confirmation followed reports that an extortion group had claimed Expedia data. (Skift, Nov 12)
- What the company said. In the statement quoted by Skift, Expedia Group said: "We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group." It said it contained the issue as soon as it became aware, is investigating with outside security experts, and that its platforms "remain safe to use for both travelers and partners." (Expedia Group, via Skift, Nov 12)
- Vendor, data and scale unconfirmed. Expedia has not named the compromised vendor. It has not said what information, if any, was taken, which of its travel brands were involved, or how many people may be affected. (Skift, Nov 12)
- Unverified extortion claims. Skift reported that the extortion group n0n threatened to publish what it claims is stolen Expedia data, according to Cybernews. Those figures have not been independently verified, and Expedia's statement does not confirm them. We are not repeating the claimed counts. (Skift, Nov 12)
- A similar vendor-access attack, not confirmed as the same incident. On November 9, 2026, Wiz, working with Sentra and Mandiant, published research on a threat actor that used credentials from an AWS account associated with Qubole, a cloud data platform, between October 14 and October 26, 2026, to assume access roles that Qubole customers had created. Sentra said some former Qubole customers had never revoked that access, and that those roles could still read nearly all of the data the attacker went after. Skift noted that Qubole was a onetime Expedia vendor. Expedia has not confirmed that its incident is related to Qubole, and Wiz and Sentra have not publicly named Expedia as one of the affected customers. (Wiz, Nov 9, Sentra, Skift, Nov 12)
Who should worry
- You book travel through Expedia Group brands, including Expedia, Hotels.com or Vrbo. The company has not said whether your data was taken. Watch for official messages from Expedia, and treat unexpected emails, texts or calls about your booking or your points as suspicious until you can check them on the official site or app.
- You run a website, store or booking site that shares customer data with vendors, or that still has old vendor access in place.
If you do not book through Expedia Group and you do not share customer data with vendors, this notice does not apply to you.
What to do now
If you book travel through Expedia Group. These steps follow from what the company has and has not said, not from the unverified extortion claims.
- Use official channels. Expedia says its platforms remain safe to use for travelers and partners. For questions about your account, go to the official site or app yourself. Do not use a link from an unexpected message. (Expedia Group, via Skift, Nov 12)
- Watch for phishing. Even while the company has not confirmed what data was taken, a public breach report is often followed by fake emails, texts or calls that pretend to be Expedia, a hotel or an airline. Do not enter a password, card number or points login on a page you reached from a message you were not expecting.
- Wait for Expedia if it has something specific to tell you. The company has not published a list of affected data or a count of people. Do not assume your data was taken, and do not assume it was not.
If you run a website, store or booking site. These are general steps, not from Expedia. We are not claiming any tool, including EverThread, would have stopped this attack.
- Make a list of every vendor that can still reach your customer or booking data, including data platforms, analytics tools, fulfillment companies and old integrations you no longer use.
- Remove access you no longer need. Wiz and Sentra found that some former Qubole customers had left vendor access in place long after they stopped using the service, and that those leftover roles were enough for the attacker to reach their data. Revoke unused roles, keys and integrations, then confirm they are gone. (Wiz, Nov 9, Sentra)
- Rotate keys and passwords for any vendor that still needs access, and give each vendor only the data it actually needs.
- Know how you would tell customers if a vendor was breached, including who can approve cutting off that vendor.
What to send your developer, agency or host
Expedia Group confirmed on November 12, 2026 that attackers reached its systems through a compromised third-party data platform provider, in a supply chain attack that also affected other companies. It has not named the vendor or said what data, if any, was taken. Separately, Wiz and Sentra documented an October 14 to 26 attack in which credentials tied to Qubole were used to assume vendor access roles, including at former customers that had not revoked that access. Expedia has not confirmed a link to that research. Please list every vendor, integration and key that can still reach our customer, booking or account data, including unused or former vendors. Please revoke access we no longer need, rotate the keys for vendors we still use, and tell us how we would cut off a vendor and notify customers if we had to. Sources: Expedia Group statement via Skift, November 12, 2026; Wiz and Sentra, November 9, 2026.
Common questions
Does this mean my site was hacked?
No. This notice is about a breach Expedia Group confirmed at its own systems, through a vendor. It does not mean your site was hacked. The useful lesson for site owners is to review vendor access, including access you thought you had already turned off.
Was my Expedia data stolen?
Expedia has not said what information, if any, was taken, or how many people may be involved. An extortion group has claimed a large customer-data haul; those claims have not been independently verified. Watch for official messages from Expedia, and be careful with unexpected booking or points messages.
Was this the Qubole attack?
Expedia has not named the vendor and has not confirmed a link. Wiz and Sentra documented a Qubole-related attack in October, and Skift noted that Qubole was a onetime Expedia vendor, but the researchers have not publicly named Expedia as one of the affected customers. (Skift, Nov 12, Wiz, Nov 9, Sentra)
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your vendors, your cloud roles or what customer data a travel site or a vendor holds, and we cannot tell you whether your Expedia account was involved.
Is there anything to update?
There is no named software flaw and no CVE or patch for this incident. If you run a site, reviewing and revoking old vendor access, and rotating keys, is still worth doing.
Where can I follow official updates?
Follow Skift's report of the Expedia Group statement, and the Wiz and Sentra research on the separate Qubole vendor-access attack. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Skift: Expedia Confirms Cyberattack Through Third-Party Vendor, November 12, 2026 (8:53 PM ET), checked November 13, 2026. Includes the Expedia Group statement.
- Wiz: Trusted by Default: Qubole Cross-Account Access Abused in the Wild, November 9, 2026, checked November 13, 2026.
- Sentra: Inside the Qubole Supply Chain Attack: How Sentra Found It, checked November 13, 2026.