New Booking.com Data Breach Forces Reservation PIN Resets

Booking.com Confirms Unauthorized System Access Exposing Customer Data

Booking.com has confirmed a data breach after detecting unauthorized access to its systems that exposed sensitive customer reservation and account information. The company has begun notifying affected customers individually and is forcing reservation PIN resets as an immediate mitigation step.

The breach was disclosed on April 13, 2026. Booking.com's statement to security media confirmed the incident: the company detected unauthorized third-party access to customer data and has launched an investigation while implementing containment measures.

What Was Exposed

Booking.com indicated the breach exposed reservation and personal contact data. The company confirmed that financial and payment card data was not compromised.

Booking.com did not publicly disclose the number of affected customers.

Immediate Response: Forced PIN Resets

Booking.com has mandated reservation PIN resets for all affected accounts. The reservation PIN is used to confirm or modify bookings over the phone and verify identity when contacting Booking.com customer support — making its exposure a meaningful security concern for account takeover via social engineering.

Customers receiving breach notification emails should:

1. Reset their reservation PIN immediately through the Booking.com account portal
2. Review active reservations for any unauthorized changes or cancellations
3. Update account passwords as a precaution if the same credentials are reused elsewhere
4. Be alert to phishing — scammers are already impersonating Booking.com in follow-on attacks

Follow-On Phishing Campaigns

Security researchers and Booking.com itself have warned that scammers are exploiting the breach notification to launch phishing attacks. Fraudulent emails and SMS messages impersonating Booking.com are being sent to customers, often requesting:

• Credit card numbers to "re-verify" compromised reservations
• Account password resets via malicious links
• Payment of fraudulent "rebooking fees"

Booking.com advises customers that it will never request payment card information via email, phone call, or text message following a breach. Any such request should be treated as a scam.

Booking.com's Breach History

This is not the first time Booking.com has dealt with a significant security incident. The platform has historically been targeted by property-side fraud — where attackers compromise hotel partner accounts and use them to contact guests with fraudulent payment requests. This 2026 breach represents a different attack vector targeting customer-side data directly at the platform level.

The travel and hospitality sector has become an increasingly attractive target due to:

• High-value PII including travel itineraries and contact data useful for targeted fraud
• Reservation systems that can be abused for financial fraud (fake rebooking demands)
• Trust exploitation — customers expect to receive communications from booking platforms

What Customers Should Do

Immediate Steps

1. Check email for Booking.com breach notification
2. Log in to Booking.com and reset your reservation PIN
3. Review all upcoming and recent reservations for unauthorized changes
4. Enable two-factor authentication if available on your account
5. Be suspicious of ANY Booking.com communications asking for payment details

Watch for These Phishing Red Flags

• Emails claiming your reservation needs to be "re-confirmed" with payment
• Links to Booking.com lookalike domains (b00king.com, booking-secure.com, etc.)
• Urgent language demanding immediate action to avoid cancellation
• Phone calls from "Booking.com support" requesting card details

What Booking.com Has Not Disclosed

The company has not publicly revealed:

• The attack vector or root cause of the breach
• The total number of affected customers
• The timeframe during which unauthorized access occurred
• Whether any credentials or internal systems beyond customer data were accessed

An investigation is ongoing. Customers should monitor for further updates from Booking.com and watch for suspicious activity on linked email accounts or travel loyalty programs.

References

• BleepingComputer — New Booking.com data breach forces reservation PIN resets
• TechCrunch — Booking.com confirms hackers accessed customers' data
• The Register — Booking.com warns of possible reservation data exposure