Ctrip · Breach

Alleged sale of 401 million Ctrip customer records

Nov 03, 2026 · 1 min read

A threat actor on a dark web forum claims to sell a dataset of 401 million records from Ctrip (Trip.com Group), China's largest online travel platform, for $1,500 in crypto. Alleged data includes names, phone numbers, addresses, user IDs and hotel, rail and flight booking history. Ctrip has not confirmed an incident; the claim is not confirmation of a breach.

By HIFY Radar newsroom Updated 11/03/2026 12:10 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on a dark web forum is selling a dataset of 401 million records they claim came from Ctrip, China's largest online travel platform. The asking price is $1,500 in crypto. Ctrip has not confirmed an incident.

Why it matters

If real, customer personal data and travel history would be exposed to scams. According to the analysis, fields such as next departure date would make travel-themed phishing far more convincing. The 401 million figure may include duplicates or older aggregated data.

What to do

Alert staff and customers who use the platform about travel-themed scams and phishing attempts. Monitor official channels for confirmation or denial from Ctrip. There is no fix to apply.

For the technical team

Affected: Ctrip (Trip.com Group) Ctrip, maior plataforma de viagens online da China; base alegada de 401 milhões de registros de clientes oferecida por U · Ctrip (Trip.com Group), China's largest online travel platform; alleged dataset of 401 million customer records.
Exploitation: Alleged sale on a dark web forum, reported by DailyDarkWeb, with an asking price of $1,500 in crypto. Unverified threat-actor claim; Ctrip has not confirmed an incident.
Fix: No fix applicable. Mitigation: watch for phishing attempts and travel-themed scams.
More details: Alleged fields: full names, phone numbers, street addresses, user IDs, account status, registration dates, hotel, rail and flight booking counts and history, upcoming departure dates and payment totals. The DailyDarkWeb analyst notes that fields such as last booking and next departure suggest fairly recent data, and that the 401 million figure may include duplicates or older aggregated data.