Brands
Booking.com suffers data breach, leaves guests’ personal details exposed
The travel giant faces fresh scrutiny after criminals accessed customer reservation details in its latest security lapse
AMSTERDAM: Booking.com, the world’s largest accommodation platform, has been hacked. Unnamed criminals broke into the Dutch firm’s systems and made off with a trove of guests’ personal data, including names, email addresses, phone numbers and reservation details, in what the company is calling an attack by “unauthorised third parties”.
The firm, which lists more than 30m properties and shuttles millions of travellers through its platform each year, has been tight-lipped about the scale of the breach. It has refused to say how many customers were affected, though it insists that financial data was left untouched. Cold comfort for those whose private details are now floating in criminal hands.
In a letter to affected guests, the company confirmed that the hackers may have accessed “certain booking information” tied to past reservations, along with anything customers had shared directly with their accommodation. Pin numbers for affected bookings have since been reset, the digital equivalent of changing the locks after the burglars have already left.
This is not Booking.com’s first dance with cybercrime. In 2018, fraudsters used phishing tactics to filch login credentials from hotel staff in the United Arab Emirates, eventually harvesting booking data from more than 4,000 customers. The company then compounded the damage by reporting that breach to the Dutch privacy regulator 22 days late, earning itself a €475,000 fine. The current breach has yet to be fully assessed, but regulators will be watching closely.
The wider platform has also been plagued by scammers impersonating properties to extract payment details from travellers ahead of their trips, a problem that has grown faster than the company’s appetite to solve it.
Booking.com is owned by Booking Holdings, the $137bn American behemoth that also controls OpenTable, Agoda and Kayak. Its parent may have deep pockets, but no amount of money appears to be buying it a clean security record.
For a company whose entire business is built on trust, this is becoming an alarmingly expensive habit.
