Booking.com Phishers May Leave You With Reservations
Summary: A California hotel's Booking.com credentials were stolen and used to send phishing messages inside the Booking mobile app minutes after a customer made a reservation, claiming anti-fraud verification was needed; Booking.com confirmed a partner suffered an incident but said its internal systems were not compromised. Booking.com now enforces 2FA for partners via its Pulse app, SecureWorks traced similar partner-targeting malware to at least March 2023, and Booking.com told the BBC in June 2024 that traveler phishing rose 900 percent, while one email address tied to a phishing domain was used to register more than 700 others in a month.
What you should know: One registration email address produced over 700 phishing domains in a single month, and a Russian-language forum post offered up to $5,000 per compromised hotel account - a market price that tells you how much stolen partner credentials are worth to attackers.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026