2026 Expedia Group — n0n leak-site claim (unverified)
Data compromised
Actor claim, unverified: loyalty-program tables, traveler profiles, credential-like tokens, booking events, Vrbo reservation records and cloud credentials. Row counts in the listing are not a unique-people census. recordsAffected stays 0 until the company or a regulator matches it.
Technical writeup
Leak-site listing 9 Nov 2026. No official Expedia notice located. Do not add dump links. Keep separate from expedia2018 and expedia2006.
Root cause
Ransomware group n0n listed Expedia Group, Inc. on 9 November 2026. Unverified. Expedia had not confirmed a matching incident on pages reviewed the same day. Actor copy lists very large loyalty, credential and booking-table row counts. Treat those figures as an advert, not a census.