Booking.com confirms data breach exposing user contact and reservation info

Booking.com has confirmed that unauthorized third parties accessed some users’ booking data, including full names, email and postal addresses, phone numbers, and messages exchanged with property providers. The company has not disclosed how many customers were affected, but said impacted guests will be notified directly.

After detecting suspicious activity, Booking.com said it contained the issue and reset PIN codes for current and past affected reservations. Users were contacted by email from noreply@booking.com, and the company stated that financial information, including payment details, was not accessed.

The notification warns users to watch for suspicious emails or phone calls, avoid clicking links in unsolicited messages, and remember that Booking.com will not ask for sensitive personal data or bank transfers. Some customers were confused by the lack of in-app alerts, while others reported scam attempts referencing private reservation details, with some even being contacted through WhatsApp due to the exposure of their private phone numbers.