Data breach leaks sensitive, private, and financial data of millions of customers from Booking.com, Expedia, Hotels.com, and others who use Prestige Software
The list of online booking sites affected by the breach includes some of the top industry giants including Booking.com.
Context & Ripple Effects
The Prestige Software breach is the latest entry in a recurring hospitality pattern: guest data leaking through the industry's plumbing rather than its storefronts. Expedia already saw an attacker pull roughly 880,000 payment cards from Orbitz's customer database in 2018, and Marriott's 500M-record Starwood theft showed how long a reservation-system compromise can run undetected.
What distinguishes today's story is the intermediary layer: Booking.com, Expedia, and Hotels.com are named because they use Prestige Software's reservation infrastructure, echoing [[a:940501|Symantec's finding that ~67% of 1,500 surveyed hotel sites were inadvertently passing guest booking data to third parties]]. The brand customers book with may not be where their data is lost.
First-order effects
- Millions of guests who booked through Booking.com, Expedia, Hotels.com, and other Prestige Software clients have sensitive, private, and financial records exposed, with those brands now owning the customer-facing fallout for a vendor's failure.
Second-order effects
- Hotel chains and OTAs will be forced to audit their reservation-software suppliers' security postures rather than treating compliance as each brand's own problem, since the Prestige exposure shows the attack surface sits with whoever aggregates bookings.
Third-order effects
- If the pattern from Orbitz to Marriott to Prestige holds, hospitality will drift toward contractual and regulatory accountability for third-party data handlers — GDPR-era enforcement aimed at processors, not just the consumer-facing brands.
The trend: Travel booking breaches keep recurring at the industry's least visible layer, pushing security responsibility up the supply chain from individual hotels to the vendors that centralize guest data.