2018 Booking.com — 4,109 UAE customers, 283 credit cards
Data compromised
Names, addresses, phones, bookings, credit cards, CVV
Technical writeup
Telephone scam targeted 40 UAE hotels; staff revealed Booking.com credentials. Hackers accessed 4,109 customer records: names, addresses, phones, booking details. Credit card info for 283 people including 97 CVV codes. Fined €475,000 for reporting breach 22 days late (72-hour GDPR deadline).
Root cause
Social engineering; hotel staff credential theft