Booking.com Notifies Some Customers of April Data Breach Involving Names, Emails and Booking Details

Com suffered a data breach in April 2026 that exposed names, email addresses, phone numbers, and booking details of some customers, the company said. No financial information was exposed in the incident. Wired reported that the travel portal has emailed affected customers to alert them to the heightened risk of scams.

The breach has increased concern around reservation hijacking, a digital scam in which scammers use details about a booking to trick victims into sending money. Scammers can obtain booking details by targeting employees of hotels or travel companies, exploiting data breaches, accessing email accounts, or viewing social media posts.

With personal and reservation data now circulating, fraudsters can more convincingly impersonate legitimate staff from hotels, spas, car rental firms or airlines.

Com stated it will never ask customers to share credit card information over the phone, email, or text. The company also will never ask customers to make any kind of payment, like a bank transfer, that is different from the payment details in their booking. These reminders were included in communications with affected users following the April 2026 breach.

Reservation hijacking attempts often arrive via phone calls, emails or text messages and frequently introduce urgency, such as claims of a payment mix-up that must be fixed immediately or a need to secure a reservation with a quick transfer. Scammers may claim to represent a hotel or travel provider and cite specific trip details to build credibility before requesting money.