Booking.com has reported a security incident involving ‘unauthorised parties’ accessing customer data.
The company has taken immediate steps to contain the issue and is notifying customers directly.
The incident involved an undisclosed number of reservations in which information was accessed.
In a statement the company said: “At Booking.com, we are dedicated to the security and data protection of our guests. We recently noticed some suspicious activity involving unauthorised third parties being able to access some of our guests’ booking information.
“Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests.”
Andy Ward, SVP International at Absolute Security, commenting on broader industry trends, said: “The vast amount of sensitive personal information, ranging from contact details to banking data, held by organisations like Booking.com makes them a prime target for cybercriminals. Any organisation can be targeted, especially in an era where threats move at AI speed. Whether it’s human-targeted AI phishing attacks or breaches caused by unpatched devices, everyone must be prepared for when, not if, an attack occurs.
“The shift for security leaders must be towards cyber-resilience in order to remain operational in the face of an attack. It’s no longer enough to simply prevent attacks. Our research shows that critical security software currently fails to protect devices around 20% of the time, giving attackers open access for significant periods of time.
“Security teams must prioritise getting devices and security controls back to an operational state, restoring them to the latest patch levels, and putting recovery systems in place to avoid falling victim to the era of downtime.”
Booking.com is co-operating with relevant authorities and regulators as part of its ongoing investigation.
