Booking.com announced a platform hack and user data leak
Online booking platform Booking.com has been hacked: the company has confirmed the leak of customers' personal data, including contacts and travel details.
Online booking platform Booking.com has been hacked: the company has confirmed the leak of customers' personal data, including contacts and travel details.
Online booking platform Booking.com has been hacked: the company has confirmed the leak of customers' personal data, including contacts and travel details.
According to the BBC, the attackers gained access to names, email addresses, phone numbers and booking information — both future and past. The company notes that bank card details were not affected by the incident.
Booking.com said it had detected unauthorized access to some reservations and had taken swift action to limit the spread of the problem. It has already started sending warnings to users about the increased risk of fraudulent messages.
The stolen data allows attackers to contact customers on behalf of hotels. These messages can use real travel details, such as property names, check-in dates, or contact information. This makes phishing attacks more convincing and difficult to detect.
Users have already reported suspicious emails and messages asking them to clarify their payment or resolve a «booking issue.» Booking.com emphasizes that the service does not request payment details via email, instant messengers, or phone, and does not change payment terms beyond the booking confirmation.
Booking spoofing schemes have existed before, but they were usually based on hacking into hotel accounts on Booking.com. In the new case, the attackers gained access to customer data, which allows them to directly contact potential victims. According to cybersecurity experts, such leaks significantly increase the effectiveness of the fraud, since each request looks like a regular communication from the service or hotel.
Previously, dev.ua wrote about how cybersecurity researchers discovered a new wave of attacks on Ukrainian iPhone users. It used the DarkSword tool, which allowed for quick extraction of personal data from the phone without long-term monitoring of the victim.



