Travel platforms face data breaches and targeted phishing risks

Recent data breaches at several travel and accommodation platforms have raised concerns regarding sophisticated phishing attacks. MyRealTrip confirmed a breach on August 25, involving user names, emails, phone numbers, dates of birth, encrypted passwords, and in some cases, passport numbers and expiration dates. While payment information was reportedly not compromised, the company has strengthened its monitoring systems and notified relevant authorities.

Other companies, including Nol Universe (regarding former Interpark Tour customers) and the B2B platform Onda, have also reported leaks involving names, contact details, and specific booking information such as accommodation names, stay dates, and purchase amounts.

Experts warn that the exposure of specific booking details enables ‘spear phishing,’ where attackers impersonate service providers to request urgent re-payments or credit card updates via fake websites. Similar incidents have been reported globally, including at Booking.com and through the Japanese reservation management system Demaraz. Users are advised to verify all booking communications through official websites or customer service centers and avoid clicking suspicious links.