Six major travel companies were breached in the past 12 months. It is not a coincidence — the travel sector holds a uniquely dangerous combination of data, and criminals are systematically exploiting it.
The travel industry stores three types of data that criminals prize above almost everything else: passport numbers (permanent, cannot be changed), itinerary details (used to craft convincing impersonation scams), and payment card data .
Six major travel companies were breached between mid-2025 and mid-2026. The pattern is not random — it is targeted.
If you have traveled in the past few years or belong to a travel loyalty program, your personal information may be at risk. IdentityIQ identity theft protection can help you detect possible suspicious activity and respond quickly.
The 2025 to 2026 Travel Breach Wave: A Timeline
The Carnival Corporation and Booking.com breaches made headlines in April and May 2026, but they are part of a sustained wave of attacks on the travel sector that began in mid-2025.
June 2025 — Qantas Airlines: 6 Million Customers Affected
Hackers used social engineering to gain access through a call center employee. Names, birthdates, email addresses, phone numbers, and frequent flyer numbers were exposed.
July to August 2025 — KLM and Air France: Loyalty Program Data
Unauthorized access to a third-party customer service platform exposed names, contact details, and loyalty program information for customers of both airlines. Source: Fox News.
December 2025 to January 2026 — Eurail: 308,777 Travelers
1.3 terabytes of data were stolen including names, passport and ID numbers, passport photocopies, dates of birth, IBAN numbers, and in some cases health information. Attackers published the data publicly after extortion demands failed.
April 2026 — Booking.com: Full Reservation Details
Customer names, email addresses, phone numbers, physical addresses, and complete booking details were accessed by unauthorized third parties. Criminals immediately used the stolen data in WhatsApp phishing attacks impersonating hotels.
April to May 2026 — Carnival Corporation: 5,995,277 Passengers
A social engineering attack on a single employee account exposed names, addresses, emails, phone numbers, dates of birth, driver’s license numbers, and passport numbers across all nine Carnival brands. Source: The Record.
Why Travel Companies Are Prime Targets
Nearly every major travel breach in this wave involved compromise of a third-party platform or a human employee rather than a direct technical attack on the company’s core systems. This is the ShinyHunters and Cl0p playbook: exploit the weakest link in the supply chain.
The data that travel companies hold is uniquely valuable for three reasons.
1. Passport Numbers Are Permanent Identifiers
A stolen credit card number is replaced within days. A stolen passport number cannot be changed on demand — and when combined with a name, date of birth, and home address, it gives criminals everything they need to pass identity verification at banks, lenders, and government agencies.
Stolen passport data is actively bundled and sold in criminal markets as a complete identity profile, dramatically increasing both the price criminals charge for it and the damage it can cause.
2. Itinerary Data Enables Targeted Social Engineering
The Booking.com breach demonstrated this in real time. Criminals who know your hotel name, booking reference number, check-in date, and home address can send messages that are nearly indistinguishable from legitimate communications.
The FBI’s 2025 Internet Crime Report, released in April 2026, identified social engineering as the primary driver of cybercrime losses — not technical exploits. Travel data is the raw material for exactly this type of attack.
3. The Travel Sector Is Structurally Vulnerable
Hotels, cruise lines, booking platforms, and rental car companies all rely on extensive third-party integrations — reservation systems, loyalty platforms, customer service tools, and payment processors. Each integration creates an attack surface.
The Qantas, Air France, KLM, and Booking.com breaches all involved third-party platform compromises rather than the core company’s own systems. The travel industry’s reliance on vendors means perimeter defenses alone are not enough.
How Big Is the Problem?
The scale of cybercrime and data breaches in 2025 and 2026 makes clear that no sector is immune — but travel is among the hardest hit.
- $21 billion in U.S. cybercrime losses were recorded in 2025, according to the FBI IC3 Annual Report released in April 2026.
- 3,322 data breaches were recorded in 2025, a five-year record, according to the Identity Theft Resource Center Annual Report.
- 6 or more major travel companies were breached between mid-2025 and mid-2026, based on public disclosures.
What Travelers Should Do Differently in 2026
The most important shift for 2026 is understanding that proactive protection is no longer optional. The question is not whether your travel data will ever be exposed, but whether you will find out quickly enough to limit the damage when it is.
1. Place a Fraud Alert
Contact one of the three major credit bureaus — Equifax®, Experian®, or TransUnion® — and place a fraud alert on your credit file. This is especially important if you have traveled internationally in the past three years. You only need to contact one bureau and they are required to notify the others.
2. Consider Freezing Your Credit
A credit freeze is one of the strongest protections available. It prevents anyone from opening new accounts in your name, even if they have your passport number or Social Security number. It is free at all three major credit bureaus.
3. Watch for Suspicious Messages
Never trust a WhatsApp, SMS, or email payment request that references your booking details, however accurate those details appear. Criminals use real booking data to make scam messages look legitimate.
- Do not click links in unexpected messages from hotels, airlines, or booking platforms
- Go directly to the company’s official website to verify any request
- Be especially cautious of messages that create urgency or ask for payment
4. Enroll in Three Bureau Monitoring
Many companies offer free credit monitoring as part of a breach response, but those offers often only cover one credit bureau. A hard inquiry or new account at a bureau that is not being monitored will go undetected.
IdentityIQ identity theft protection monitors all three major credit bureaus and sends an alert when possible suspicious activity is detected, so you are covered regardless of where a criminal tries to open an account. See IdentityIQ protection plans.
5. Use a VPN on Public Wi-Fi
Hotel, airport, and cafe Wi-Fi networks are common targets for data interception. IdentityIQ Bitdefender® Total Security VPN encrypts your internet traffic across up to 10 devices, helping keep your browsing and personal data private when you are connected to public networks.
Help Protect Your Identity After the Travel Breach Wave
Six major travel companies breached in 12 months is not a streak of bad luck. It is a coordinated pattern that shows criminals know exactly what travel data is worth and how to get it.
What matters now is staying informed and getting ahead of the risk before your information is used against you.
Look for protection that covers:
- Real time credit monitoring across all three major credit bureaus
- Dark web monitoring for your personal information
- Alerts when possible suspicious activity is detected
- Identity restoration support if your identity is stolen
IdentityIQ identity theft protection is built around all of these features. Click here to get protected now.
Final Thoughts
The travel breach wave of 2025 and 2026 is a reminder that the personal data you share when you book a trip can follow you long after you return home.
Passport numbers, itinerary details, and loyalty program data are not just inconvenient to have stolen. They are exactly the kind of information criminals need to commit identity fraud for years.
The best thing you can do is place a fraud alert, monitor your accounts, and stay alert to unexpected messages that reference your travel history.
If you have concerns about protecting yourself after any of these breaches, contact IdentityIQ today.
Frequently Asked Questions About Travel Identity Theft in 2026
Common questions about Travel Identity Theft in 2026:
Why is the travel industry targeted for data breaches more than other industries?
The travel industry holds three types of data criminals prize highly: passport numbers (permanent, cannot be replaced), itinerary details (used to craft convincing scams), and payment card information.
Travel companies also rely heavily on third-party integrations which create multiple attack surfaces. Security researchers have documented that nearly every major travel breach in 2025 to 2026 involved compromise of a third-party vendor rather than the company's own systems.
How long does stolen travel data remain useful to criminals?
Stolen travel data, particularly passport numbers, dates of birth, and home addresses, can remain useful to criminals for years.
Unlike credit card numbers, passport numbers cannot be changed on demand. Security researchers note that the highest-risk window for new-account fraud from a breach is 30 to 120 days after stolen data reaches criminal markets, but travel data with passport numbers carries a longer-term risk profile.
Am I at risk if I booked travel years ago?
Yes. The Carnival Corporation breach included data from the Holland America Mariner Society loyalty program, meaning customers who joined years ago but have not sailed recently may still be affected.
If you have ever booked with any Carnival Corporation brand or joined a related loyalty program, review your credit reports and consider placing a fraud alert.
What should I do if I think my travel data was stolen?
Place a fraud alert at one of the three major credit bureaus, consider placing a credit freeze, monitor your financial accounts closely, and report any suspected identity theft to the FTC at IdentityTheft.gov. Enrolling in identity theft protection with dark web monitoring can also help you detect possible suspicious activity early.
Related Articles
The Booking.com breach is part of a broader wave of travel industry attacks in 2025 and 2026. These articles cover the full picture:
- Carnival Data Breach 2026: What Was Stolen, Who Is Affected, and What to Do Now
- Booking.com WhatsApp Scam 2026: How It Works & What to Do
Sources
- Fox News — Air France and KLM warn customers of new data breach (August 2025)
- The Record — Cruise giant Carnival confirms data breach affecting 6 million (2026)
- FBI IC3 — 2025 Internet Crime Report
- IdentityIQ — 10 Tips for Traveler Identity Theft Protection
