Travel Booking Data Breaches Expose Millions to Scams

Millions of travelers have been put at risk by data breaches affecting major travel companies, including Booking.com, Amtrak, Carnival, KLM, and Air France. These incidents have exposed a wealth of personal information, which scammers are now using to execute sophisticated phishing attacks and identity theft schemes.

During the booking process for trips, customers often provide sensitive data such as full names, home addresses, phone numbers, email addresses, travel dates, payment details, and even passport numbers. While individually these pieces of information may seem innocuous, collectively they create a comprehensive profile that scammers can exploit.

How Scammers Leverage Stolen Data

Scammers can use the detailed information obtained from data breaches to make fraudulent communications appear legitimate. For instance, a scammer who knows a traveler's hotel and check-in dates can send a fake message impersonating the hotel, claiming payment issues and prompting the victim to re-enter their credit card details. Such messages can feel like a genuine inconvenience rather than a scam, especially if they arrive before official breach notifications.

These tactics can extend to family members. Scammers may use knowledge of travel plans and family contacts to initiate fake emergency calls, such as a "grandchild stranded abroad" scenario, which gains credibility due to the accurate timing and names involved.

Industry-Wide Vulnerabilities

Even bookings made through trusted travel companies are not entirely immune. Data breaches have occurred across the industry, often due to vulnerabilities not within the main company but within their extended network of partners. A single employee's compromised device or an attack on a third-party vendor can lead to widespread data exposure.

Recent incidents highlight the scale of the problem:

• Booking.com (April 2026) reported that unauthorized third parties accessed reservation data, including names, emails, phone numbers, hotel details, and confirmation numbers. While financial data was not compromised, scammers used this information to send fraudulent WhatsApp messages to travelers before official notices were issued.
• Amtrak (April 2026) experienced a data exposure affecting over 2.1 million customer accounts, revealing names, email addresses, physical locations, and customer support records.
• Carnival (June 2026) confirmed a breach impacting nearly 6 million individuals following a social engineering attack. Exposed data may have included names, contact details, dates of birth, and government-issued ID numbers.
• KLM and Air France (August 2025) reported a breach through a third-party customer service platform, exposing names, contact details, and frequent-flyer numbers.

Protecting Yourself Before Travel

Travelers can take several steps to mitigate the risks associated with booking trips online:

• Verify All Communications: Treat any message reporting a booking problem with suspicion, especially if it requests personal details or clicking links. Instead, contact the company directly through its official website or a verified phone number.
• Use Credit or Virtual Cards: Credit cards generally offer better fraud protection than debit cards. Using virtual card numbers for bookings can provide an extra layer of security, allowing compromised numbers to be deactivated without affecting primary accounts.
• Enable Account Alerts: Activate transaction alerts for payment cards used for travel bookings and review security settings on travel accounts. Utilizing a password manager for strong, unique passwords and enabling two-factor authentication (2FA) are crucial defenses.
• Limit Stored Data: Avoid saving passport, ID, or payment card details within travel apps, especially after a trip. Remove stored sensitive documents when they are no longer needed.
• Establish Family Code Words: A pre-agreed code word among family members can quickly identify and thwart emergency scams.
• Reduce Data Broker Footprint: Services that remove personal information from data broker sites can make it harder for scammers to connect travel details with other identifying information, thereby increasing the difficulty of executing more elaborate scams.