Booking.com customers warned of 'reservation hijacking' after hack
The travel platform said it had changed Pins to protect customers but would not say how many were affected.
www.bbc.comHere’s a concise update on the Booking.com data breach as of now.
Core answer
- Booking.com has disclosed a data breach that may have exposed certain customers’ personal data, including names, email addresses, phone numbers, and booking details. The company says it detected suspicious activity, contained the incident, and updated reservation PINs; financial information was not reported as compromised. [Citations follow after each claim.]
Details and recent developments
- Timeline and scope
- The breach was publicly acknowledged in April 2026, with Booking.com informing affected users that unauthorized third parties may have accessed booking information. The company stated it took action to contain the incident and to protect impacted bookings by changing PINs. [Cite after each sentence: Booking.com notification and containment steps.][2][4]
- What data could be exposed
- According to Booking.com, possible exposed data includes booking details such as hotel name, check-in/check-out dates, reservation references, and information shared with accommodations, along with personal identifiers like names, email addresses, physical locations, and phone numbers.[4][2]
- Financial data
- Booking.com has stated that no financial information was compromised in the incident.[4]
- Media and security context
- Coverage across outlets has highlighted concerns about phishing and targeted scams using leaked booking data, with some reports noting customers received phishing attempts via messaging platforms tied to their reservations.[9][4]
- Company communications
- The company has emphasized that protecting customer data is a top priority and that it is continuing to work with impacted guests to mitigate risks.[4]
What you can do to protect yourself
- Monitor for phishing attempts and scams that reference your Booking.com reservation data. Be cautious with messages asking for personal information or asking you to click unfamiliar links.[9][4]
- Review recent Booking.com reservations for any unfamiliar activity and update passwords or authentication where applicable. If you receive direct updates from Booking.com, verify authenticity via official channels (the site or the app).
- Consider enabling two-factor authentication on your Booking.com account if available and ensure your contact email/phone are up to date so you receive legitimate alerts.
Sources you can check for the latest details
- Booking.com data breach notes and customer communications (April 2026)[4]
- Coverage and summaries from tech and security outlets discussing data types exposed and risk considerations (April–May 2026)[2][9]
- Additional reporting on related phishing warnings and consumer guidance (April 2026)[3][9]
If you’d like, I can pull the latest articles from reputable outlets and summarize any new official statements from Booking.com, or help you assess your own exposure based on whether you used Booking.com for reservations.