June–July 2026: Crypto-native travel agency Travala (Travala Pte. Ltd.) disclosed unauthorized access to customer personal data reported to U.S. state regulators — including names, emails, addresses, passport details, usernames, hashed passwords, two-factor data, and cryptocurrency wallet addresses. Vermont filed June 29, 2026; legal summaries cite Nebraska AG reporting. Canonical: travala-unauthorized2026. Sources: Federman & Sherwood, GalaxyWarden/VT AG summary.
Travala sits at the intersection of passports, email logins, and on-chain addresses — a trifecta for both traditional identity theft and crypto-targeted phishing (“confirm your AVA wallet to release your booking”).
What happened: Travala data breach timeline
Travala detected improper access and copying of customer personal data, contained activity, and engaged external cybersecurity specialists per its regulator filings summarized by Federman & Sherwood (July 1, 2026 blog citing Nebraska AG notice). Vermont’s attorney general received a related filing June 29, 2026. Public AG summaries vary in per-state victim counts; a nationwide total had not been uniformly published in sources reviewed at indexing.
What data was exposed in the Travala breach?
Regulator-facing summaries and consumer-law analyses list fields that may include:
- Names, email addresses, mailing addresses, phone numbers
- Nationalities and dates of birth
- Passport numbers and expiration dates
- Usernames and hashed passwords
- Linked sign-in service information and two-factor authentication details
- Cryptocurrency wallet address information
Exact fields vary by account. Treat any password hash as credential-stuffing risk if you reused the Travala password elsewhere.
Who is at risk?
Travala.com account holders who booked hotels or travel with crypto or card. Users who stored passport data for international bookings. Anyone who linked a hot wallet for AVA rewards or payments — expect targeted phishing referencing real booking dates if actors pair travel CRM with chain analytics.
Crypto travel platform context
Travala markets Web3 travel bookings (AVA token, wallet integrations). Breaches at crypto-adjacent consumer brands often see follow-on scams on Telegram and X pretending to be “support” with seeded transaction hashes. Legitimate Travala support will not ask for seed phrases.
What Travala said
Company-facing summaries describe strengthened monitoring, regulator notification, and customer guidance on phishing vigilance. If you received a state-mandated notice letter, preserve it as proof of exposure.
Action items
- Change your Travala password and every reuse of it; use a password manager.
- Enable hardware or app-based MFA on email — the real blast radius.
- Rotate API keys / linked exchange accounts if you connected wallets.
- Ignore “refund to your wallet” DMs; book support only via travala.com.
- Monitor passport-related fraud (new mobile accounts, KYC alerts) if passport data was listed in your notice.
Canonical record and sources
Catalog: travala-unauthorized2026 — recordsAffected 0 pending company nationwide census; companyConfirmed true. Related: Carhartt, Fanlore.
Search coverage: Travala data breach, Travala hack 2026, crypto travel booking leak, Travala passwords exposed, was I affected Travala, Web3 travel agency breach.
Genetic-test PHI is irreversible — you cannot rotate a diagnosis like a password. EOB and lab-result phishing spikes for months after clinical lab notices.
Airport parking and WiFi sign-ups feel low-risk until a scammer knows your plate, postcode, and travel dates. MAG-scale contact lists power convincing “your Stansted booking failed” SMS.
Museum and nonprofit breaches often sit quiet for a year before letters — class actions follow when members learn from press, not mail.
Crypto travel platforms hold passports and wallet addresses together — a rare combo for KYC bypass and SIM-swap follow-on.
Hashed passwords still matter when people reuse the same string on email and exchange accounts. Rotate Travala + every reuse; enable hardware MFA on email first.
Texas hunting-license victims already have a dedicated BreachHistory blog — do not confuse TPWD with Texas DPS (a separate 2024 driver-record incident).
Carhartt and Boston Scientific August 2026 blogs are live on BreachHistory — check those canonical pages before re-sharing actor-inflated counts.
Freeze credit when SSN appears in a lab or museum letter; monitor Explanation of Benefits when only insurance IDs were listed.
NCSC and ICO guidance after UK breaches: ignore unexpected payment links; airports never ask for card details by cold call.
Open bookmarks to official portals now so you are not searching under panic later.
Secondary scams include fake IDX enrollment portals and fake “class action payout” forms that harvest more PII.
Support agents become targets when CRM context leaks — brief them before customers forward breach screenshots.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.