Booking.com Notifies Some Customers of April Data Breach Involving Names, Emails and Booking Details

Com suffered a data breach in April 2026 that exposed names, email addresses, phone numbers, and booking details of some customers, the company said. No financial information was exposed in the incident. Wired reported that the travel portal has emailed affected customers to alert them to the heightened risk of scams.

The breach has increased concern around reservation hijacking, a digital scam in which scammers use details about a booking to trick victims into sending money. Scammers can obtain booking details by targeting employees of hotels or travel companies, exploiting data breaches, accessing email accounts, or viewing social media posts.

With personal and reservation data now circulating, fraudsters can more convincingly impersonate legitimate staff from hotels, spas, car rental firms or airlines.

Com stated it will never ask customers to share credit card information over the phone, email, or text. The company also will never ask customers to make any kind of payment, like a bank transfer, that is different from the payment details in their booking. These reminders were included in communications with affected users following the April 2026 breach.

Reservation hijacking attempts often arrive via phone calls, emails or text messages and frequently introduce urgency, such as claims of a payment mix-up that must be fixed immediately or a need to secure a reservation with a quick transfer. Scammers may claim to represent a hotel or travel provider and cite specific trip details to build credibility before requesting money.

com offers two-factor authentication on customer accounts.

The company advises users to stick to official apps and channels for any communication and to verify the identity of anyone requesting information or payment by contacting the business directly through known official numbers. If doubt exists, customers should avoid sharing details or rushing into transactions.

Wired reported that the fundamentals of avoiding reservation hijacking mirror standard scam defenses: strong, unique passwords, caution with unsolicited contact, and verification before acting on any request involving money.

The breach itself occurred in April 2026, with notifications sent shortly afterward as the company worked to inform those impacted.