Booking.com has confirmed unauthorized access to its systems exposed sensitive reservation and user data, prompting the company to force users to reset their reservation PINs.
Booking.com detected the breach after identifying suspicious activity within its infrastructure. The company confirmed the incident to BleepingComputer, stating that attackers gained access to a portion of its user database containing reservation details and account information.
The exposed data includes reservation numbers, user names, email addresses, and encrypted booking information. Users with active reservations were notified of the breach and required to reset their reservation PINs—the codes used to access and modify bookings without logging into an account.
Booking.com has not disclosed the exact number of affected users or provided details about how attackers infiltrated its systems. The company stated it has secured the compromised systems and is investigating the scope of the unauthorized access.
Reservation PINs are particularly valuable to attackers because they allow direct access to booking details without requiring passwords. By resetting these codes, Booking.com aims to prevent unauthorized modifications to existing reservations, which could be used for fraud or extortion.
The breach is the latest incident affecting a major travel platform. Booking.com, which processes millions of reservations annually across its platform serving 220+ countries, has faced previous security concerns but maintains its position as a primary reservation service.
The company advised users to monitor their accounts for suspicious activity and contact customer support if they notice unauthorized changes to their reservations. It also recommended using strong, unique passwords for Booking.com accounts and enabling two-factor authentication where available.
Booking.com said it is cooperating with relevant authorities and has notified affected users via email. The company did not specify when the breach was discovered or how long attackers had access to the systems before detection.
Two recently patched vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft campaigns. The zero-days were patched last week after initial exploitation was discovered.
Inexpensive GPS jamming devices are proliferating globally, disrupting navigation systems across civilian infrastructure. The low cost and easy availability of these tools are creating widespread interference zones.
Devices promising free movies are recruiting home internet connections into proxy networks without users' knowledge. The trade-off: your bandwidth and privacy.
QubesOS released a security update addressing a critical vulnerability that allows arbitrary code execution through an error reporting backchannel in the copy-to-VM function. The flaw affects multiple Qubes versions.