Expedia Confirms Breach via Compromised Third-Party Data Vendor

Expedia Group confirmed Thursday that attackers reached its systems through a compromised third-party data platform provider, in a supply chain cyberattack that also hit multiple companies.

The acknowledgment followed reports this week on cybersecurity sites about claims by an extortion group known as n0n that it had stolen Expedia data. The company has not disclosed the extent of any exposure.

In a statement to Skift, Expedia Group said: "We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia."

What has Expedia disclosed so far?

Very little that is verifiable. Expedia did not identify the compromised vendor. It did not say what information may have been exposed. The scale of the breach remains unconfirmed.

The company said it contained the issue as soon as it became aware, is investigating with outside security experts, and that its platforms remain safe for travelers and partners. Those claims are the company's own; no independent verification has been published.

For travel sellers, the unanswered questions matter most. Expedia's platforms span consumer booking brands and a large partner network of hotels, airlines and advertisers, all of which exchange data with the company's systems. Until Expedia specifies which vendor was compromised and what data the attackers could read, partners cannot assess their own exposure.

Who is behind the extortion claim?

An extortion group calling itself n0n threatened to publish what it claims is stolen Expedia data unless the company reached a settlement, according to Cybernews. No specific ransom figure appeared on the group's dark-web page.

Extortion claims are routine pressure tactics and do not by themselves prove data theft. Expedia's confirmation that attackers did reach its systems, however, gives the group's claim a factual floor — even as the volume and sensitivity of any stolen data stay unverified.

What did researchers find at Qubole?

Separately, researchers at cloud security firms Wiz and Sentra documented an attack that ran between October 14 and 26 involving Qubole, a cloud data platform and a onetime Expedia vendor.

According to the researchers:

• Attackers used compromised credentials tied to Qubole to enter multiple customers' cloud environments.
• They downloaded data from those environments.
• Sentra found that former Qubole customers never revoked the access permissions they had previously granted.
• Those unrevoked permissions could read nearly all of the data the attacker went after.

The finding points to a structural weakness in how travel companies manage vendor offboarding. Permissions granted to a data platform often outlive the commercial relationship, leaving a live access path long after contracts end. In Qubole's case, Sentra determined the stale permissions covered almost the entire dataset the attacker targeted.

Is Expedia's breach connected to Qubole?

Unconfirmed in both directions. Expedia did not confirm any link between its breach and Qubole. Outside researchers have not publicly identified Expedia as one of the affected Qubole customers.

The timing and the vendor profile — a data platform with trusted access into customer environments — align with Expedia's description of the attack. Alignment is not attribution. Neither Expedia nor the research teams have drawn the connection on the record.

Why does this matter for travel distribution?

Supply chain attacks shift cyber risk from a company's own perimeter to its vendor stack, and travel distribution runs on deep vendor integration. Booking platforms, data warehouses, analytics providers and marketing tools routinely hold read access to reservation, loyalty and customer records. Each integration is a potential entry point that the buyer cannot directly patch.

The Sentra finding sharpens that risk: the exposure was not created during the vendor relationship but after it ended, because no one revoked access. For any operator that has changed data platforms, analytics vendors or connectivity providers in recent years, the practical question is whether old credentials were retired at contract close.

Expedia, as one of the largest distribution intermediaries, will face partner and possibly regulatory pressure to name the vendor and categorize the exposed data. Its statement so far offers containment assurances without specifics, and the extortion deadline mechanics remain unclear. Whether n0n publishes the claimed data — and whether Expedia confirms the Qubole connection — will determine the commercial and compliance fallout in the weeks ahead.