BCD Travel data breach: 396K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-06-05
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets. The breach dates from May 29, 2026; Have I Been Pwned loaded it on Jun 5, 2026.
What to do
- If you had a BCD Travel account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
