Expedia confirms cyberattack via third-party vendor

On November 13, 2026, Expedia Group confirmed to Skift that attackers entered its systems through a compromised third-party data platform vendor, constituting a supply chain cyberattack affecting multiple companies at the same time. Expedia said it was aware of the supply chain attack reported by security researchers. Earlier this week, multiple cybersecurity websites reported that a ransomware group named n0n claimed to have stolen Expedia data. Currently, Expedia has not disclosed the scope of affected data, the number of users involved, or the time of the incident, and the n0n group's theft claim has not been independently verified.