According to TechCrunch, Booking.com confirmed hackers may have accessed customers' names, email addresses, phone numbers and booking details; according to BleepingComputer, it forced PIN resets for existing and past reservations and informed impacted users by email [1][2]. According to the BBC, the Dutch company has not said how many people or which regions were affected, and criminals have contacted customers posing as hotels to trick them into paying over bogus reservation problems [3]. Booking.com urges guests to stay vigilant to phishing, saying it will never ask for card details by email, phone, WhatsApp or text, or ask for a bank transfer differing from the booking confirmation's payment policy [3].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Apr 13, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Booking.com guest reservation data accessed; platform resets booking PINs and warns of fake-hotel scams
1 min read
- Disclosed
- Apr 13, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Attack vector
- Unknown
- Impact
- Data exposureFraud risk
- Data type
- Contact infoTransactions / orders
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Hospitality & food service
Timeline
Technical details
Remediation
Vendor guidance
- 1Beware of reservation hijack scams verify[3]
Never share card details via messages or calls, and refuse transfers outside your booking terms.
References
Media3
- [1]TechCrunch2026-04-13Accessed 2026-11-11Snapshot 2026-11-11 sha256 4728817bb858
“Booking.com confirmed Monday that hackers may have accessed customers’ personal data, including names, email addresses, phone numbers, and booking details.”
- [2]BleepingComputer2026-04-13Accessed 2026-11-11Snapshot 2026-11-11 sha256 cc2d78af7957
“The company took immediate action, forced PIN resets for existing and past reservations, and informed impacted users directly via email.”
- [3]BBC2026-04-15Accessed 2026-11-11Snapshot 2026-11-11 sha256 61629c1e5c01
“"Booking.com will never ask guests to share credit card details by email, over the phone, Whatsapp or text, or ask guests to make a bank transfer that is different from the payment policy details in their booking confirmation," it added.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.