Expedia Group has confirmed that attackers reached its systems through a compromised third-party data platform provider. The admission, made in a statement to travel trade outlet Skift on Thursday US time (around lunchtime Friday 13 November in Sydney), follows days of claims by a data-extortion group calling itself n0n that it stole hundreds of millions of customer records.
Expedia Group also owns Australia’s Wotif, as well as Hotels.com and Vrbo, so this matters to plenty of Australian travellers. Here’s what has been confirmed, what is only claimed, how a forgotten vendor connection may have been the way in, and what you should do now.
What Expedia has confirmed
Expedia’s statement is brief. “We are aware of a supply chain attack, reported by security researchers, in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group,” the company said. In the version reported by Forbes, it added: “We take our travelers’ privacy extremely seriously,” and “Our platforms remain safe to use for both travelers and partners.”
That is all Expedia has said publicly. It has not named the vendor, said what data was taken, said which of its brands or countries are affected, or said whether customers will be notified. When we checked the US Securities and Exchange Commission’s EDGAR database on 14 November (Sydney time), Expedia Group had not filed a Form 8-K under Item 1.05, the item US-listed companies use to report a material cybersecurity incident. Its most recent 8-K, filed on 4 November, covers its quarterly results.
What the attackers claim
According to Cybernews, which reported on the group’s leak-site claims, n0n says it holds:
- about 830 million rows of loyalty-program data across 35 programs, including email addresses, member IDs, tiers, booking values and points balances in 21 currencies
- about 58 million traveller profiles, including email addresses, account dates and home airports
- about 333 million account records pairing account IDs and email addresses with what Cybernews describes as “password-like tokens”
- live credentials for Expedia’s big-data platform, source-code repositories and a production cloud environment
None of this has been independently verified, and Expedia hasn’t said whether the incident it confirmed is the one n0n describes. Rows are also not people: one customer can appear many times across tables, so the real number of affected travellers is likely far smaller than the headline figures. Closer to home, Cyber Daily reported on 12 November that Australian email addresses appear in material the group has posted on the dark web.
How a forgotten vendor connection can open the door
Expedia’s wording closely matches a campaign that cloud security firm Wiz disclosed on 9 November (US time), working with data security company Sentra and Google’s Mandiant. Wiz says that between 14 and 26 October an attacker used credentials from an AWS account associated with Qubole, a big-data platform, to assume the access roles that Qubole’s customers had set up in their own Amazon Web Services accounts. Once inside, the attacker harvested stored passwords and keys and downloaded data from storage buckets.
The striking part is that many of those doors had been left open. Sentra says “dozens of Qubole customers were impacted”, and that Qubole roles “were still in place long after companies had stopped using Qubole.” Skift describes Qubole as a onetime Expedia vendor. Wiz has since added that an actor calling itself n0n has claimed responsibility for the Qubole intrusions.
That is still not proof of a link. Expedia has not named Qubole, and neither Wiz nor Sentra has publicly named Expedia as a victim. Amazon told BleepingComputer that “AWS services were not compromised by this issue and operated as designed.” In other words, the weak point was a trusted vendor connection, not Amazon’s cloud itself. It’s the second vendor-access story we’ve covered this week, after attackers abused ScreenConnect remote-support access at managed service providers.
What it means for Australians
Expedia Group’s own history page lists Wotif among the brands it acquired, alongside Orbitz and Travelocity. We don’t yet know whether Australian accounts at Expedia, Wotif or Hotels.com are in the data n0n is holding, so don’t assume you’re affected or that you’re not.
Under the Privacy Act, an organisation that must comply with the Act has to tell you if a breach involving your personal information is likely to cause you serious harm, according to the Office of the Australian Information Commissioner (OAIC). Expedia hasn’t said whether it will notify customers in any country, so the steps below are precautions rather than a response to a confirmed exposure.
What to do now
- Expect convincing travel scams. Booking and loyalty data lets scammers write messages that mention real trips, hotels or points balances. Treat unexpected emails, texts, WhatsApp messages or calls about refunds, cancellations, “payment problems” or points with suspicion, even if the details look right.
- Go direct. Check any booking by opening the official Expedia, Wotif or Hotels.com app or typing the address yourself, never through a link in a message. Don’t pay a hotel or “agent” through a new link or bank transfer you were sent out of the blue.
- Fix reused passwords. If you use the same password for a travel account and anything else, change it everywhere it’s reused, starting with your email. The OAIC recommends changing email account passwords and turning on multi-factor authentication if contact details are involved.
- Watch your points and cards. Keep an eye on loyalty balances and card statements, and report anything you didn’t make to your bank straight away.
If you run systems on AWS, the lesson is more direct. Wiz recommends reviewing CloudTrail logs from 1 October for activity from Qubole’s account, rotating every secret those roles could read and revoking active sessions, deleting integration roles that are no longer used, and limiting the rest to a vendor’s documented network ranges. More broadly, it’s a good time to audit every third-party integration you no longer use. Stolen and exposed credentials have been a recurring theme this month, including in the Chainalysis breach.
Our read
In our view, the most important detail here isn’t the eye-watering row counts, which remain unverified, but how the attack apparently worked: old vendor access that nobody switched off. Big companies routinely audit who their staff can reach, but trust given to a supplier years ago can outlive the contract. Expedia’s brief confirmation also leaves customers guessing, and we’d like it to say quickly which brands and regions are affected and whether Australians should expect a notice. Until then, the safest assumption for any Expedia, Wotif or Hotels.com customer is that scammers may know where you’ve travelled.
Featured image: Expedia Group’s headquarters campus in Seattle, photographed in December 2019 (not supplied by Expedia). Photo: T014y, via Wikimedia Commons, licensed under CC BY-SA 4.0; resized and converted to PNG. The adapted image is shared under the same licence.
