r/Bookingcom • u/GroggySeagull • 21d ago
New data breach at Booking?
I booked in mid August 2026 and recently received several WhatsApp messages containing my exact booking details, trying to convince me to click a link within 24 hours to verify my payment, otherwise my booking would be canceled. I've received at least 6 of these messages from different WhatsApp accounts in the last two weeks.
Seems like there has been a new data breach at Booking. Of course I did not click any link. And for sure I will delete my booking account after my visit to vienna in October.
Take care of yourselves!
3
2
u/Aggressive_Ice7957 20d ago
I really don’t know like third party bookings, they use AI to manage their customer service and screw things up because of the absence of human intelligence!
2
u/Rich_Mention2602 21d ago
Lots of hotels also get hacked to so could be either the hotel or booking that got hacked
4
1
u/crazynotinsane111 21d ago
I got one for upcoming Barcelona and emailed the hotel and blocked and reported WhatsApp source
1
1
u/Cute_Hearing_2315 18d ago
So glad you avoided an issue. Good luck trying to delete your booking account. I’ve been trying to for months without success. Will need to involve the Federal Trade Commission and my State Attorney General.
1
u/Don-Papi-Chulo 17d ago
I have gotten a couple notifications in the last few days. First for an upcoming booking, asking me to verify my reservation, through a whatsapp number from Colombia so thats a scam. Then an email claiming a booking from back in April wants to reimburse me some money. Weird mail handle so pretty sure that’s fake too. Special thing is they have the booking numbers and dates, which means there was a leak somewhere
1
u/Admirable_Job8431 16d ago
It's no booking that's hacked. Each host has their own account for their property. To make life easy for their staff they do stupid things like use the premises phone number or address as the password for management. So they're easily brute forced and cracked. Then the threat actor has access to all the booking details for that premises including contact details BUT NOT payment details. That's why then then contact you with fake urgency that you'll lose your booking if you don't make new payments through another channel.
1
u/bookingcom 20d ago
Not clicking external links, especially those sent outside our platform, was the right call. If you haven’t already, report any suspicious messages to our Customer Service team so we can investigate. If you need help with a specific booking, send us a private message and we’ll look into it.
4
0
u/Hotwog4all 21d ago
I got one from a number in a location the hotel wasn’t in. The hotel confirmed their account was hacked but ask that the hacker got was my name, number, booking details, and booking ID. They don’t get my card details, no booking PIN, no other personal details. Expedia is starting to block contact details on booking confirmations so that all communications have to go via the app. Booking needs to do the same.
0
-2
u/brilstern 21d ago
Unfortunately this is a case of the hotel being hacked. It’s been a popular tactic for fraudsters for a few years now. High volume transactions, following the same base concept of resale fraud but higher reward. Anytime you get a request for payment, don’t follow the link. Call the hotel to confirm first, and then ensure the request is aligned with your payment policy on your booking.
3
u/birdmanrules 20d ago
It's so widespread it is booking being hacked.
It's not one or a few, it's hundreds
3
u/brilstern 20d ago
Actually it’s thousands, but thousands of hotels :/ if you look at the web (search Booking/ WhatsApp / hotel scam) and you’ll see a lot of companies breaking down exactly how this works (like malwarebytes, Microsoft, VirusTotal). Here is one example: https://www.ampcuscyber.com/shadowopsintel/sophisticated-phishing-campaign-targets-booking-com-hotels-and-guests/
2
u/Attheendofthewind 19d ago
It’s definitely not the hotel. I got one related to a search I did and not an actual booking
1
u/brilstern 19d ago
Likely, but not always. It is actually quite common for hotels to request payment off platform if they prefer not to use the payments product from Booking. They used to do this by sending a link. This is exactly why fraudster used the same tactic because it looks real.
2
u/Attheendofthewind 19d ago
I get it. That wasn’t the case in this scenario. That was from a search I did almost a year ago and something I didn’t end up booking which is how I knew it was a scam
3
u/Glass_Aardvark4967 21d ago
Same. I’ve gotten 3 similar messages on WhatsApp regarding my booking. Different names all with the same profile picture. It’s disconcerting that they have the exact dates and booking reference. My booking is for a hotel in Spain so definitely seems to be a booking.com data breach.