Expedia Group Cybersecurity Incident Class Action Investigation

Personal information belonging to travelers who used Expedia Group may be at risk following a cybersecurity incident. If you believe your personal information may have been exposed in the Expedia Group cybersecurity incident, our data breach lawyers want to hear from you.

What Happened?

According to a posting on a dark web leak site, a cybercriminal group claimed responsibility for a cybersecurity incident involving Expedia Group. The claim was reportedly posted in November 2026. The threat actor claimed the information potentially involved may have included loyalty program records, traveler profiles, account records with password-like tokens, and booking records. Expedia Group has not publicly confirmed the cybersecurity incident, and its full scope remains under investigation. The claim was reportedly made by a group known as N0n, which said it obtained roughly 58 million traveler profiles.

If you are a customer or employee who did business with Expedia Group, you may be eligible for compensation. Fill out the form below to see if you qualify.

Steps To Take If You Were Affected

1. Monitor your credit reports and financial accounts for suspicious activity
2. Consider placing a fraud alert or credit freeze with all three major credit bureaus
3. Be alert to phishing emails or calls referencing the incident
4. Change passwords on any affected accounts and enable two-factor authentication
5. Keep any letters or notices you receive about the cybersecurity incident for your records