Threat watch / Breach
Expedia: attackers reached its systems through a compromised third-party data platform provider
Expedia Group confirmed to Skift on November 12, 2026 that attackers gained access to its systems through a compromised third-party data platform provider, whose trusted access was used to reach several companies. Expedia did not name the vendor or say what information may have been exposed. An extortion group called n0n claims the theft and threatens to publish the data, according to Cybernews as reported by Skift.
- Sector
- Transport
- Way in
- Supplier
- Product or vendor
- None named
- How it happened
- Through a compromised third-party data platform provider: the attackers used its trusted access to reach several companies, Expedia Group among them, according to Expedia. Expedia says: "We are aware of a supply chain attack, reported by security researchers". It did not name the vendor.[1] Checked 14 Nov 2026
- What was stolen
- Not public yet Checked 14 Nov 2026
- Who was impacted
- Not public yet Checked 14 Nov 2026
- Threat actor
- Not attributed. Claimed by the extortion group n0n, according to Cybernews as reported by Skift. Expedia has not attributed the attack.
Timeline
- Expedia confirms to Skift that attackers gained access through a compromised third-party provider. It says it contained the issue as soon as it became aware and is investigating with outside security experts, and has not disclosed the extent of any data exposure. [1]
- An extortion group called n0n claims the theft and threatens to publish the data unless a settlement is reached, according to Cybernews as reported by Skift. This is the group's claim; Expedia has not confirmed what was taken. [1]
- Skift recalls that Wiz and Sentra documented an October attack using credentials tied to Qubole, a onetime Expedia vendor. Expedia has not confirmed a link, and the researchers have not named Expedia as an affected customer. [1]