What happened. Expedia Group confirmed on Thursday, Nov 12, that attackers reached its systems through a compromised third-party data platform provider, in a supply chain attack that also hit other companies. In a statement to Skift, Expedia said it contained the issue as soon as it knew, is investigating with outside security experts, and that its platforms remain safe for travelers and partners. It did not name the vendor or say what data was taken.
The claim. The confirmation follows a leak-site listing this month by a new extortion group called n0n, which says it holds more than 830 million loyalty-program rows, 58.3 million traveler profiles and 333 million account and credential records, plus live credentials for Expedia's big data platform and production cloud access (per Cybernews). Cyber Daily reports a partial dataset has since been posted and may be partly historical. None of those counts have been verified, and Expedia has not commented on them.
The possible link. Skift notes that Qubole, a cloud data platform Expedia once used, was abused from Oct 14 to Oct 26: attackers used Qubole's own AWS credentials to step into customer clouds through roles those customers had created to trust it, and Sentra found many ex-customers never removed that access. Expedia has not said its breach is tied to Qubole, and researchers have not named Expedia as a Qubole victim. Our Qubole brief has the details.
Why it matters. If a single data-platform vendor can open the door to a company the size of Expedia, the risk is in the access you granted years ago, not just today's vendor list. Find every cross-account cloud role and API key held by a data vendor, delete the ones you no longer use, and rotate what those identities could read. If you are an Expedia, Hotels.com or Vrbo customer, expect travel-themed phishing that uses real booking details.