The Expedia ransomware claim emerged on 9 November 2026, when the N0N extortion group named Expedia Group on its leak site. Despite alleging an exceptionally large data exposure, the group provided no evidence that it possesses the information.
Public leak-site monitors captured the listing on the same day, but they only corroborate that N0N published the claim. As of 9 November 2026, no sample records, screenshots, technical indicators or independently verified data had appeared.
What the Expedia ransomware claim alleges
N0N described the Expedia listing as a data exposure rather than a conventional ransomware attack involving system encryption. The listing reportedly used the wording ‘not paid, exposed’, although no ransom demand, payment deadline or specific financial amount was included in the monitored text.
The actor claimed to have obtained 830 million loyalty-programme rows stored across 800 files. According to the listing, those files contain consumer email addresses, loyalty member identifiers, points balances, membership tier details and booking values.
N0N also alleged possession of a traveller-profile table containing approximately 58 million rows. A separate account and credential archive was said to contain more than 333 million records associated with email addresses, although the group did not publish samples showing what the alleged credentials represent or whether they remain valid.
Booking, Vrbo and cloud data claims
The Expedia ransomware claim extends beyond loyalty information. N0N said the material includes booking and trip records, card-spend data, consumer matching datasets, car-rental shopping activity, hotel and property information, and booking-to-ledger extracts.
The actor specifically referenced Vrbo reservation and payment records. It also claimed to hold nearly 497,000 guest communications containing information about stays, along with loyalty activity metrics covering more than 36 million rows.
Another part of the listing alleged that information had been taken from five additional cloud accounts. N0N put the total at approximately 747 GB across 582 storage locations, but supplied no directory listings, cloud logs or other artefacts through which this figure could be checked.
The listing further mentioned a 174 GB workforce-planning database backup dated 21 October 2026. That is only the date attributed to an allegedly obtained backup. It does not establish when an intrusion occurred, how long access may have lasted or whether Expedia Group’s systems were compromised at all.
Alleged access credentials
N0N claimed to possess access credentials for a big-data platform, source code repositories and a production cloud environment. These assertions would be significant if verified because working credentials could potentially enable continued access, but no redacted credential examples, authentication logs or cloud audit evidence accompanied the listing.
No affected software product, version or configuration was identified. The Expedia ransomware claim concerns alleged access to datasets and online environments, not a disclosed vulnerability in an Expedia or Vrbo product. There is consequently no vulnerability identifier, affected-version list or proof-of-concept exploit associated with this event.
Timeline of the N0N Expedia listing
- 21 October 2026: N0N’s narrative dates an allegedly obtained workforce-planning database backup to this day. The date and possession of the backup remain unverified.
- 9 November 2026: Open-source leak-site monitors first recorded N0N naming Expedia Group and reproduced summaries of the alleged data.
- 9 November 2026: No matching Expedia Group incident advisory, newsroom announcement or material-incident filing had been identified. No independent proof of data possession had surfaced.
There is no confirmed compromise date in the available material. Treating 21 October 2026 as the date of an attack would therefore be inaccurate, as it appears only as metadata described in the actor’s own narrative.
Some third-party monitoring services refer to the group as dAn0n or use different capitalisation for n0n. These variations appear to refer to the same leak-site ecosystem and do not provide independent corroboration for the Expedia ransomware claim.
Why the Expedia ransomware claim is unverified
The central verified fact is limited: N0N published a listing naming Expedia Group. That does not prove that the company suffered a breach or that any of the listed datasets exist in the form described.
Leak-site operators can exaggerate stolen volumes, combine material from older sources or name organisations without possessing their data. Separate research into another operation, 0APT, previously found fabricated victim claims and an absence of supporting proof. That assessment was not about N0N or Expedia, but it demonstrates why a leak-site post cannot be treated as confirmation by itself.
N0N has been tracked as a data-extortion operation since September 2026 and has posted batches of claims that remain unverified. General profiles describe a focus on stealing data and applying pressure without necessarily encrypting systems, sometimes through compromised credentials. However, those observations about wider activity do not establish what happened in this case.
No evidence of active exploitation or publication
As of 9 November 2026, reputable sources had published no indicators of compromise connected to the Expedia ransomware claim. There were no validated IP addresses, domains, file hashes, malicious file paths, cloud artefacts or exposed credentials for defenders to investigate.
There was also no independent evidence that the alleged data had been distributed beyond the text of the listing. Multiple trackers mirrored the actor’s description, but repeating the same claim does not amount to separate confirmation.
Expedia Group had not issued a matching security advisory or newsroom statement. Its recent regulatory filings also contained no Item 1.05 Form 8-K reporting a material cybersecurity incident. The absence of a disclosure does not disprove the allegation, but it means no material incident had been publicly confirmed through those official channels.
What the claim means for UK organisations
UK businesses using Expedia Group or Vrbo services should monitor official company communications rather than treating the listing as a confirmed breach. At present, there is no event-specific indicator that organisations can block or search for.
The publicity may nevertheless be used in phishing, password-reset fraud or credential-stuffing attempts. Criminals could impersonate Expedia, Vrbo, travel providers or security teams and refer to the Expedia ransomware claim to make urgent messages appear credible.
- Verify Expedia or Vrbo security notices through official websites and established account channels.
- Do not follow unsolicited links requesting password changes, payment details or loyalty account verification.
- Use unique passwords and multi-factor authentication on travel, loyalty and connected business email accounts.
- Review sign-in alerts and unexpected changes to bookings, points balances or account contact details.
- Treat anyone offering alleged Expedia data as suspicious unless the claim is confirmed through authoritative channels.
For now, the appropriate assessment is cautious but clear. A potentially serious allegation has been made, yet the Expedia ransomware claim remains unsupported by proof, technical findings or an official confirmation.
Originally reported by redpacketsecurity.com.
