Booking.com data breach

In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

The company detected suspicious activity and took immediate steps to contain the data breach, including resetting PINs for impacted bookings.

Affected data includes names, email addresses, phone numbers, booking details and any additional information guests shared with accommodations – such as arrival times or special requests. Booking.com has confirmed that financial data, credit card numbers and physical addresses were not accessed from its systems.

The company has not disclosed how many customers are affected or in which countries they are based. It is contacting individuals it believes face a heightened risk of fraud directly.

What are your rights?

Under UK GDPR, Booking.com has a legal obligation to protect your personal data. When that obligation is breached, you have the right to seek compensation – even if you have not suffered direct financial loss. Distress, anxiety and loss of control over your personal data are all recognised grounds for a claim.

You also have the right to ask what data was exposed and how the incident occurred. Consumers can also complain to the Information Commissioner’s Office (ICO), whether or not they choose to pursue a compensation claim.

Want to know your rights after a data breach? Read our complete consumer guide covering compensation, groups claims, what counts as harm, what to expect and how to protect yourself.

What data breach compensation could you receive?

There is no fixed amount for data breach compensation. The value of a claim depends on the type of data exposed, the distress caused and whether you suffered any downstream harm such as fraud or identity theft attempts.

Factors that affect the amount include:

  • Financial losses. Any losses linked to fraud or identity theft resulting from the breach can form the basis of a material damages claim.
  • Emotional distress and anxiety. Distress caused by the misuse of your personal data is a recognised form of non-material harm and can support a claim independently of any financial loss.
  • Time and inconvenience. Time spent dealing with the consequences of the breach, including handling suspicious communications, changing passwords or monitoring accounts, can be included.
  • Phishing and ongoing risk. Cybersecurity experts have warned that stolen data is likely to be sold and used to craft convincing phishing scams. Any fraud or financial loss resulting from such activity would strengthen a claim further.

Get updates about this data breach and potential claims

Register for updates

What happens when you register?

Updates about the Booking.com data breach. Including major developments, compensation claims or important next steps.

Alerts about other data breaches and consumer claims. Including new group claims and other relevant consumer action.

Our free monthly newsletter. With practical updates on consumer rights, compensation claims and access to justice.

Frequently asked questions

If you have ever made a booking through Booking.com, your data may have been exposed. The company has not confirmed the full list of affected customers. Those at heightened risk are being contacted directly. All Booking.com users should take precautions regardless of whether they have received a notification.

Booking.com disclosed the breach in April 2026, stating it detected suspicious activity and immediately took steps to contain the issue. The precise date the unauthorised access began has not been confirmed publicly.

No. Booking.com has confirmed that financial information and physical addresses were not accessed. The data exposed relates to booking information: names, email addresses, phone numbers and reservation details.

Register your interest using the form on this page. This is free and does not commit you to anything. You will be contacted when a formal claim opens and can decide at that point whether to proceed.

A reservation hijack scam is when fraudsters contact you pretending to be your hotel, using real booking details to make the approach appear legitimate. They then attempt to collect payment information or redirect payments outside the Booking.com platform. If you receive any unexpected payment request related to a booking, contact the hotel directly using official contact details and do not click links in messages. Booking.com has confirmed it will never ask customers to share card details by email, phone, WhatsApp, text or bank transfer outside the original booking process

Yes. In 2018, criminals used phishing tactics to gain access to the booking data of more than 4,000 customers. Booking.com reported that breach to the Dutch privacy regulator 22 days late and was fined €475,000 (£415,000) as a result. There have also been multiple reported cases of reservation hijack scams targeting Booking.com customers since 2023.

Are you affected?

Register for updates about this data breach and potential claims.

Register for updates

Booking.com is contacting customers it believes are directly impacted, but the scale of the breach is unclear. If you have a Booking.com account or have made a reservation in recent years, you should treat this as a potential risk.

You may have been affected by the Booking.com data breach if you:
  • Have a Booking.com account and have made one or more reservations through the platform
  • Received a notification email from Booking.com about suspicious activity or a PIN reset
  • Received unexpected contact from a hotel or accommodation using details that match a real booking
  • Provided additional personal details to a property when booking – arrival times, special requests, dietary requirements

You do not need to have received a direct notification to be eligible. The full scale of this breach has not been confirmed.

Share this…

Data breach claims you can join

  • Legal Aid Agency data breach

    If you applied for legal aid between 2007 and 2025, you could be eligible for a group claim. Register your interest to find out.

  • Capita data breach

    Capita was fined £14m after a 2023 cyber attack exposed millions of people’s data. Register for updates on the ongoing legal action.

  • Facebook data misuse

    Facebook faces a £2.1bn legal claim that alleges it exploited 46m UK users by unfairly profiting from their data. Sign up to stay updated.

Take a look at our Group claims page to see all of our current claims.

  • Southern Water data breach

    On 22 January 2024, Southern Water discovered a cybercriminal claim that data had been stolen from its IT systems. On 12 February 2024, it confirmed that data from a limited part of its servers had been compromised following an illegal intrusion.

  • 23andMe data breach

    Between April and September 2023, a hacker accessed 23andMe using login credentials stolen from previous unrelated data breaches, exposing the personal information of 155,592 UK residents.

  • NHS Synnovis data breach

    In June 2024, criminal hackers stole patient data from Synnovis, a pathology provider serving several NHS hospitals & GP surgeries across south east London.

  • ManoMano data breach

    In January 2026, a hacker stole personal data from ManoMano, claiming approximately 37.8 million accounts across Europe were affected.

  • Co-op Member data breach

    In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.

  • CarGurus data breach

    In February 2026, CarGurus, the online marketplace used by millions of people to research and buy cars, had its customer data stolen.

  • Lloyds Banking Group breach

    Lloyds, Halifax and Bank of Scotland customers may have had sensitive financial data exposed in the March 2026 breach. Learn your rights.

  • M&S data breach

    M&S data breach. In April 2025, Marks & Spencer experienced a cyber attack that caused widespread disruption across its digital operations.

Latest data breach news