Expedia confirms attackers entered systems through a data vendor

What Expedia confirmed

Expedia Group said on November 12 that attackers reached its systems through a compromised third-party data platform provider. The company said it contained the issue after becoming aware of it and is investigating with outside security experts. It also said its platforms remain safe for travelers and partners.

What is unknown

Expedia has not named the vendor. It has not said what information may have been affected, and it has not disclosed the scale of the breach.

The extortion claim

The n0n group has threatened to publish data it says it took from Expedia unless the company agrees to a settlement, according to Cybernews as cited by Skift. Skift reports that no specific ransom appeared on the group's dark-web page. Treat the claim as unverified until Expedia or outside researchers confirm it.

A possible wider campaign

Wiz, Sentra and Mandiant reported that between October 14 and 26, an attacker used credentials tied to Qubole, a cloud data platform, to enter customer AWS environments. Sentra found that former Qubole customers never revoked the access they had granted. Expedia has not said whether its incident involves Qubole, and outside researchers have not named Expedia as a victim.

For any company that gave a vendor standing access to its cloud accounts, the case is a reason to review those grants and remove access for vendors no longer in use.