Expedia Group · Breach

[Single source] n0n group claims massive data theft from Expedia

Nov 09, 2026 · 1 min read

The n0n extortion group listed Expedia on its leak site as not paid and claims theft of about 830 million loyalty-program rows, 58 million traveler profiles and 333 million accounts with password-like tokens. The group also claims booking and Vrbo payment records plus live cloud and source-code access tokens. Expedia has not confirmed an incident and no samples have been independently verified; customers should watch accounts and transactions.

By HIFY Radar newsroom Updated 11/09/2026 12:38 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

The N0n data-extortion group has listed Expedia Group on its leak site, marked "not paid, exposed," and claims the theft of roughly 830 million loyalty-program rows plus traveler profiles, account records with password-like tokens, booking and Vrbo payment records, and live cloud and source-code access tokens.

Contested

Expedia has not confirmed an incident and no samples have been independently verified. The figures come only from the group's own listing, so this should be treated as an unverified threat-actor claim rather than confirmation of a breach.

What happened

Observed

N0n listed Expedia Group (expedia.com) on its leak site with the notation "not paid, exposed," indicating the group asserts its extortion demand went unmet and the stolen material has been exposed.

Alleged

In the listing, the group claims approximately 830 million loyalty-program rows, a 58-million-row traveler profile table, 333 million account records containing password-like tokens, booking and Vrbo payment records, and live cloud and source-code access tokens.

Why it matters

Inferred

If the claimed theft is real, the primary risks are phishing and account takeover against travelers and loyalty-program members, since the group says it holds account records tied to password-like tokens.

Inferred

The group also claims live cloud and source-code access tokens, which would create a risk of follow-on intrusions into Expedia systems beyond the initial data exposure, according to the analyst note accompanying the report.

What to do

Inferred

The analyst note recommends treating the listing as an unverified threat-actor claim, not confirmation of a breach, and advises expecting travel-themed phishing campaigns either way, whether or not the claimed theft proves genuine.

Confirmed and still uncertain

Observed

What is known: N0n has publicly listed Expedia on its leak site marked "not paid, exposed," and the group makes specific claims about the volume and types of data taken, including loyalty, traveler, account, booking, payment, and credential material.

Contested

What is unknown: Expedia has not confirmed any incident, no data samples have been independently verified, and every figure in the claim originates from the extortion group's own listing, leaving the scale and authenticity of the alleged theft unestablished.

What people are saying

Observed

The dark-web monitoring account DailyDarkWeb, which surfaced the listing, cautions that the claimed figures come only from the group itself and that the situation should be treated as an unverified threat-actor claim rather than a confirmed breach of Expedia.

Evolution

Observed

N0n is described as a newly active extortion group that has recently posted many large US retail and finance targets in bulk on its leak site, with Expedia now added among the listed victims.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

According to the group's listing, the stolen material includes 333 million account records containing password-like tokens, booking and Vrbo payment records, and live cloud and source-code access tokens, the latter posing potential direct system-access risk beyond data exposure.

Sources and evidence

Observed

This brief is based on a single source: a post by the dark-web monitoring account DailyDarkWeb on X. All figures and claims trace back to N0n's own leak-site listing; no samples have been independently verified and Expedia has not confirmed an incident.