Expedia confirms a supply-chain breach as extortion group n0n claims nearly 1 billion traveler records
Expedia Group confirmed to Skift on November 12 that attackers reached its systems through a compromised third-party data platform provider, in a supply-chain attack that also hit other companies. Expedia has not named the vendor, said what data was taken, or how many people are affected, and has not filed a material-incident 8-K as of November 13. Separately, the new Russian-speaking extortion group n0n claims it stole nearly one billion Expedia records — figures Expedia has not confirmed.
📊 Scorecard: our Bearish call on $EXPE is scored from $257.97, the last close before it ran. Its first result comes after the next close.
The News
Expedia Group confirmed to Skift on November 12 that attackers reached its systems through a compromised third-party data platform provider, in a supply-chain attack that also hit other companies. A supply-chain attack means the intruders got in through a supplier's systems rather than attacking Expedia directly. The company has not named the vendor, said what data was taken, or how many people are affected — and, per BreachNews, it had not filed a material-incident 8-K as of November 13. An 8-K is the form public companies file with the U.S. Securities and Exchange Commission when an event is serious enough to matter to investors.
Separately, the new Russian-speaking extortion group n0n claims it stole nearly one billion Expedia records — more than 830 million loyalty rows, 58 million traveler profiles and 333 million account and credential records, plus about 2.5 million credit-card spending records, 72 million consumer matching records and 500,000 guest records. The group also claims it took source code through live credentials captured the same way. Those volumes are the group's claims, not confirmed facts: Expedia has not confirmed them, and no independent source has verified the numbers. The extortion claim spread on November 13 and 14, which is the fresh hook for this story; the company's confirmation itself dates to November 12.
Cloud researchers Wiz and Sentra documented a separate attack using stolen Qubole vendor credentials between October 14 and 26, but they have not named Expedia as a victim and Expedia has not named Qubole — so whether Expedia's breach is the Qubole attack is a strong pattern match, not a confirmed fact. Qubole is a data platform provider — the kind of supplier that processes large amounts of customer data for its clients. Expedia shares closed Friday at $257.97, down 1.18%.
A billion records is the claim, not the fact — what Expedia has actually confirmed is a breach through a supplier it will not name.
Why It Matters
Supply-chain attacks are the hardest kind of breach to defend against, because the victim's own security does not matter if the attacker comes through a supplier. Expedia's systems were reached through a third-party data platform provider — a company whose job is to process data for Expedia — and the same attack hit other companies too. That pattern, one compromised vendor opening doors at several customers, is exactly what makes supply-chain attacks so damaging: the blast radius is not one company, it is every company that trusted the same supplier.
The second reason this matters is the gap between what is claimed and what is known. The n0n group's claim of nearly one billion records is enormous — 830 million loyalty rows, 58 million traveler profiles, 333 million account and credential records — but it is unverified, and extortion groups inflate their claims to pressure victims into paying. Expedia's own silence adds to the uncertainty: no vendor named, no data types confirmed, no victim count, no 8-K filing. Until Expedia or investigators confirm what was taken, the story is a confirmed breach with an unconfirmed scale.
The third reason is the data itself. Traveler records are unusually useful to criminals: the group claims email addresses, membership IDs, points balances, home airports, account details and password-like tokens — plus about 2.5 million credit-card spending records — which can be used for identity theft and for phishing — fake emails that look like they come from Expedia, because the attacker knows where you travelled and when. That is why the advice is the same whether the billion-record claim is true or not: change the password, turn on two-factor authentication, and treat any unexpected Expedia email with suspicion.
Analyst's Take
Our call is Bearish. A confirmed breach through a supplier is bad enough on its own — it means the attacker did not have to beat Expedia's own defences, only a vendor's — and the silence since then makes it worse. Expedia has not named the vendor, has not said what data was taken, has not said how many people are affected, and had not filed a material-incident 8-K as of November 13. For a company holding travel and loyalty data on hundreds of millions of people, that is a lot of unknowns, and unknowns are what worry investors and customers alike.
The n0n claim is the part that needs handling with care. Nearly one billion records would be one of the largest travel-data thefts ever — but it is a claim from an extortion group, and extortion groups have every reason to inflate their haul. The 830-million-plus loyalty rows, 58 million traveler profiles and 333 million credential records are numbers the group published, not numbers anyone has verified. The right way to read them is as a threat, not a fact: if even a fraction is real, the exposure is enormous.
Reader poll: what will you do first after the Expedia breach? Vote: Change my password, Enable two-factor, or Wait for details.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What happened to Expedia?
Expedia confirmed to Skift on November 12 that attackers reached its systems through a compromised third-party data platform provider — in plain terms, a supplier whose systems connect to Expedia's. The company has not named the vendor, said what data was taken, or how many people are affected, and had not filed a material-incident 8-K — the form public companies file when a cyberattack is serious enough to matter to investors — as of November 13.
What is the n0n group claiming?
The new Russian-speaking extortion group n0n claims it stole nearly one billion Expedia records: more than 830 million loyalty rows, 58 million traveler profiles and 333 million account and credential records. Those figures are the group's claims, not facts — Expedia has not confirmed them, and they should be treated as unverified until the company or investigators confirm what was actually taken.
What is the Qubole link?
Cloud researchers Wiz and Sentra documented an attack using stolen Qubole vendor credentials between October 14 and 26. Qubole is a data platform provider. But the researchers have not named Expedia as a victim and Expedia has not named Qubole, so whether Expedia's breach is that Qubole attack remains unconfirmed — a strong pattern match, not an established fact.
What should Expedia customers do?
Expedia has not said what data was taken, so there is no specific advice yet. The usual steps after a travel-company breach apply: change your Expedia password, turn on two-factor authentication if you have not, and watch for phishing emails — fake messages pretending to be Expedia — because stolen traveler data is often used to send convincing scams.
👁
Source: Security Affairs