People search Booking.com data breach timeline because the brand sits on billions of accounts, credentials, and cloud workloads. BreachHistory indexes 3 Booking.com-linked incidents, with headline counts up to 4K+ in catalog rows. This page maps every attested event through 2026 with internal links to canonical records.
Why Booking.com breach history matters
Booking.com operates in Technology (Netherlands). Across indexed rows, recurring themes include credential theft and social engineering. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2026 — guest reservation data accessed (phishing risk; Apr; no payment cards per company)
Cataloged incident. In mid-April 2026, Booking.com emailed customers—including in Ireland and other markets—that unauthorized third parties may have accessed booking information tied to some reservations. Public reporting (e.g., SecurityWeek, The Register) quoted the company stating it detected suspicious activity, contained the issue, and reset booking PINs as a precaution. Disclosed data categories included names, email addresses, phone numbers, physical addresses, reservation details, and content shared with accommodations via the Exposed categories include Names, emails, phones, addresses, booking/itinerary details, hotel messaging content (per company and press). No attested victim count is published for this row yet. See the booking-com 2026 record and canonical BreachHistory entry.
2018 — 4,109 UAE customers, 283 credit cards
Cataloged incident. Telephone scam targeted 40 UAE hotels; staff revealed Booking.com credentials. Hackers accessed 4,109 customer records: names, addresses, phones, booking details. Credit card info for 283 people including 97 CVV codes. Fined €475,000 for reporting breach 22 days late (72-hour GDPR deadline). Exposed categories include Names, addresses, phones, bookings, credit cards, CVV. BreachHistory cites approximately 4K+ affected records in this row. See the booking-com2018-uae and canonical BreachHistory entry.
2014 — — Booking.com: name, address, and payment card info Location of…
Cataloged incident. name, address, and payment card info Location of breached information: Payment card system Business associate present: No Exposed categories include Personal information. BreachHistory cites approximately 1 affected records in this row. See the booking-com2014 and canonical BreachHistory entry.
Patterns and analysis
- Credential theft and social engineering — appears across multiple Booking.com catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Review OAuth app permissions and revoke unused third-party integrations.
- Step 5: Bookmark the Booking.com company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/booking-com · Latest: booking-com2026.
Sources: BreachHistory catalog (3 rows for Booking.com), company and regulator disclosures cited in individual breach records.