Expedia: n0n claims ~1B traveler records stolen via unnamed third-party data platform provider
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
The extortion group n0n says it has taken close to one billion Expedia traveler records by getting into a third-party data platform provider. Its leak-site listing claims more than 830 million loyalty-program rows across 35 programs, 58 million traveler profiles, more than 333 million account and credential records, and live credentials and source code for Expedia's big data platform and cloud environment; none of this is verified. On 12 November 2026 Expedia told Skift that attackers reached its systems through a compromised third-party data platform provider in a supply-chain attack that also hit other companies. Expedia says it contained the activity, brought in outside experts and is still investigating, and that its platforms remain safe for travelers and partners. It has not named the provider, confirmed n0n or the figures, or said what data, if any, was taken. The only public candidate for the provider is a Qubole-linked AWS campaign that Wiz, Sentra and Mandiant reported on 9 November (activity 14 to 26 October 2026), and no confirmed source ties that campaign to Expedia. No sample, independent verification or CVE exists. The action is third-party risk: check which vendors hold your data and trust relationships, rotate credentials those systems could expose, and watch for phishing aimed at travelers.
What to do
- Verify scope of data exposed via the compromised third-party provider and confirm contractual breach-notification obligations
- Assess and harden third-party/vendor access to customer data; revoke and rotate credentials and tokens
- Prepare customer and regulator notifications per applicable data-protection laws
- Monitor for leaked Expedia data and targeted phishing/credential-stuffing against customers
- Review extortion communications and involve law enforcement; do not engage attackers without legal guidance
- If your estate has used Qubole integrations, review CloudTrail for AssumeRole calls from AWS account 805246085872 that come from non-AWS addresses (Wiz indicator); this is a separate campaign, not confirmed as linked to Expedia
Sources
All live incidents on Threat Watch
