On 9 November 2026 the N0n extortion group added Expedia Group, the Seattle-based online travel company behind Expedia, Hotels.com and Vrbo, to its leak site. N0n says it stole a large amount of customer, booking and cloud infrastructure data. Expedia has not confirmed an intrusion, and no regulator filing about a cyber incident has been published. The company's most recent SEC filing, a Form 8-K dated 4 November 2026, covers quarterly results and does not mention a security incident. N0n has previously listed other large companies, including Staples. Its claims should be treated the same way here: as allegations to watch closely, not established fact. If the description of the stolen data on the leak site is accurate, this would be one of the largest consumer data thefts of the year, with row counts in the hundreds of millions.
What Happened
Threat intelligence trackers recorded the listing early on 9 November. Security blog HookPhish logged the posting at 00:52 UTC. Undercode News, citing ThreatMon's daily update, also reported the claim and classified Expedia under accommodation and food services.
Accounts differ on how much N0n has actually published. HookPhish's write-up reproduces a detailed list of datasets, file counts and storage locations attributed to the leak post. Undercode News says the threat intelligence report it relied on gave no evidence of the intrusion, no samples of stolen data, no ransom demand and no count of affected people. One explanation is that the two outlets saw different versions of the listing or different summaries of it, but neither outlet has independently checked the data.
What is confirmed:
- Expedia Group appears on N0n's leak site as of 9 November 2026.
- Expedia has not commented publicly on the claim.
- Expedia's 4 November 8-K is an Item 2.02 earnings filing. No Item 1.05 disclosure of a material cybersecurity incident has been made.
What is not confirmed: whether any intrusion happened, when, what was taken, and whether any ransom demand was made.
What Was Taken
Everything in this section comes from the leak-site listing as HookPhish reproduced it. None of it has been verified by Expedia, a regulator or an established security outlet. Undercode News reports that the listing did not include volumes at all.
According to HookPhish, N0n claims to hold:
- Loyalty program tables: 830,069,282 rows across 800 files, with email addresses, member IDs, point balances in 21 currencies, tier names and booking values across 35 named programs.
- Traveler profiles: 58,380,209 rows keyed by traveler account ID, with email addresses, account dates, home airport and three years of booking values.
- Account and credential archive: 333,298,275 rows pairing account IDs and emails with what the listing calls "password like tokens". These may be hashes or session tokens rather than plaintext passwords.
- Credit bureau enrichment feeds: 438,544,802 lines of consumer bureau data loaded into the traveler profile data lake.
- Booking events: a 737-file set totalling 221.95 GB with order numbers, itinerary IDs and booking values, plus 22,949,785 trip detail rows.
- Card network spend and propensity file: 2,385,010 rows keyed by hashed email addresses.
- Consumer matching table: about 72.2 million rows keyed by customer and household IDs.
- Infrastructure access: live credentials for Expedia's big data platform, including a source code access token said to cover 19,935 private repositories, and live production cloud access.
- Five more cloud accounts: about 747 GB across 582 storage locations, including a fraud and risk event stream with traveler phone numbers and device IDs, 2026 car rental pricing events, Vrbo reservation and payment records, and booking-to-ledger reconciliation data.
Row counts are not the same as people. Loyalty and event tables usually hold many rows per customer, so the number of unique individuals would be far lower than the totals above, even if the claim is true. The most sensitive items on the list are the credential archive, the Vrbo payment records and the claimed live cloud and source code credentials. If those are real and still valid, the risk goes beyond a one-time leak to continued access.
Why It Matters
The travel sector is under sustained attack. Within the past six weeks, Amadeus, which runs reservation and check-in platforms for more than 400 airlines, disclosed a vulnerability in a travel booking display environment. Japan Airlines told customers that Amadeus systems were accessed between August 2023 and September 2026, exposing about 92,000 of its customers, according to BleepingComputer. The Record reports that Cathay Pacific (53,000 records), Singapore Airlines (46,000), Korean Air, Asiana, Malaysia Airlines and All Nippon Airways have reported related breaches. Per Cathay Pacific, Amadeus said the attackers used login credentials assigned to a system account. In Japan, the Japan Times reports that Skyticket's operator said up to 14.64 million customer records may be at risk, about 4.13 million of them including login passwords. Nothing public links these incidents to Expedia or to N0n. They do show that travel booking data, which combines identity, itinerary and loyalty value, is a prime target.
The claim describes cloud data platform theft, not classic ransomware. The listing focuses on data lakes, storage locations, cloud accounts and access tokens. It says nothing about encrypted systems. That fits a pattern defenders have seen in recent years: attackers get credentials for cloud analytics platforms, copy data out quietly, and extort the victim without deploying ransomware.
Downstream fraud risk is high if the claim holds. Loyalty points work like cash and are rarely watched as closely as payment cards. Email addresses paired with booking history make convincing travel phishing easy, for example "your reservation has a problem" messages that quote a real itinerary.
The Attack Technique
How N0n got in, if it did, is unknown. Expedia has not described an incident, and the leak-site listing as reported does not explain initial access.
The claimed loot points to a few likely routes, none confirmed:
- Stolen cloud or data platform credentials. The listing specifically claims "live credentials" for the big data platform and production cloud. Attackers commonly get these from infostealer malware on employee or contractor machines, from secrets left in code repositories, or from service accounts that lack multi-factor authentication. Amadeus's reported system-account compromise is a recent example of this route in travel.
- Source code access leading to secrets. A token with read access to thousands of private repositories would expose hardcoded keys, connection strings and deployment credentials. Those can open more cloud accounts, which would explain the claim of "five further cloud accounts".
- Exploiting internet-facing servers. Kaspersky's Securelist this week documented Storm-2603 exploiting the ToolShell SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771). The attacker ran entirely in memory inside the IIS worker process, tried to kill endpoint detection tools, and then attempted to deploy ransomware. Nothing ties that activity to N0n or Expedia, but it shows how quickly attackers move from an unpatched on-premises server to ransomware.
What Organizations Should Do
- Rotate and limit data platform credentials now. Inventory every service account, API key and access token for your data warehouse, data lake and cloud storage. Rotate anything long-lived, require multi-factor authentication or workload identity where possible, and restrict access by network location.
- Scan code repositories for secrets and review token scope. Run secret scanning across all private repositories and their history. Revoke personal access tokens that can reach the whole organization, and alert on bulk repository cloning.
- Monitor for bulk data leaving cloud storage. Set baselines and alerts for unusual export volumes, new storage destinations, cross-account copying and access from unfamiliar locations, especially on tables holding customer identity or loyalty data.
- Protect loyalty balances like payment data. Add step-up verification for point redemptions and transfers, alert on changes to account email or phone, and watch for credential-stuffing spikes against loyalty logins.
- Patch internet-facing servers and hunt for in-memory implants. Make sure on-premises SharePoint is patched against ToolShell, and review IIS worker processes for unexpected loaded modules and attempts to tamper with endpoint protection.
- Prepare customers for travel phishing. Warn customers ahead of time that you will never ask for passwords or payment details by email or text, and tell them to check bookings by logging in directly rather than following links.
Sources: Expedia Group, Inc. Data Breach: N0n Ransomware Claim (Nov 2026) | Expedia Group, Inc. Form 8-K filed November 4, 2026 | How to detect fileless attacks exploiting ToolShell: analyzing the... | More Asian airlines announce data breaches after attack on Spanish... | Japan Airlines suffers third-party data breach exposing passenger info | Robin Allen | Data leaks at travel companies could impact millions of customer re... | N0n Ransomware Claims Expedia Group as a New Victim, While Barracud...