Ethical Hacking News
In a shocking turn of events, the Russian extortion group n0n has claimed to have stolen nearly one billion Expedia traveler records through a compromised third-party provider. The breach, which is attributed to a supply chain attack, has left the industry reeling and raised concerns about the security of personal data. The n0n group's approach, which involves listing victims as "Company 89" or "Company 90" without revealing their names until the countdown ends, has sparked debate about the role of extortion groups in the cyber threat landscape. As the cybersecurity landscape continues to evolve, it is essential to prioritize data protection and take proactive measures to prevent similar breaches in the future.
Expedia suffered a massive data breach affecting nearly 1 billion traveler records. The breach was attributed to the Russian extortion group n0n and was carried out through a supply chain attack. The attackers obtained over 830 million loyalty program records, including customer email addresses and points balances. The n0n group has claimed responsibility for 224 attacks since its inception, using a unique approach that does not involve ransomware. Experts warn that the stolen password-like tokens may still be vulnerable to cracking, and the stolen data could be used for phishing attacks. The Expedia breach highlights the need for companies to prioritize cybersecurity and protect their customers' data, particularly in the context of the Internet of Things (IoT). Expedia has taken steps to contain the attack and advise travelers to change their passwords using a trusted device. The n0n group's actions have sparked debate about the role of extortion groups in the cyber threat landscape.
In recent weeks, the cybersecurity landscape has been abuzz with news of a massive data breach that has left nearly one billion Expedia traveler records vulnerable to exploitation. The breach, which is attributed to the Russian extortion group n0n, has sent shockwaves through the industry, raising concerns about the security of personal data and the increasing sophistication of cyber threats.
According to reports, the breach was carried out through a supply chain attack, in which hackers compromised a third-party data platform provider and used its trusted access to reach several companies' systems. The attackers, who are believed to be affiliated with the n0n group, allegedly obtained more than 830 million loyalty program records from 35 programs, including customer email addresses, membership IDs, and points balances.
The n0n group, which emerged in mid-September, has been making headlines for its brazen attacks on major companies. The group, which focuses on data theft and extortion without using ransomware, has already claimed responsibility for 224 attacks since its inception. Its approach is unusual, as it lists victims as "Company 89" or "Company 90" without revealing their names until the countdown ends and no deal is reached.
Experts warn that the stolen password-like tokens, which are hashed, may still be vulnerable to cracking. Additionally, the stolen loyalty program data gives hackers access to customer email addresses and points balances, which they could use to create convincing phishing messages.
The Expedia breach has raised concerns about the security of personal data, particularly in the context of the Internet of Things (IoT). With the increasing reliance on IoT devices, the risk of data breaches and exploitation is becoming more pressing. The incident highlights the need for companies to prioritize cybersecurity and take proactive measures to protect their customers' data.
In response to the breach, Expedia has taken steps to contain the attack and bring in external cybersecurity experts to investigate. The company has also advised travelers to change their passwords using a trusted device and avoid reusing the same passwords on other services.
The n0n group's actions have also sparked debate about the role of extortion groups in the cyber threat landscape. While some experts view the group's actions as a legitimate form of extortion, others see them as a form of cybercrime that can have serious consequences for individuals and businesses.
In light of this incident, it is essential to examine the broader context of cybersecurity threats and the rise of extortion groups. The Expedia breach serves as a reminder of the importance of cybersecurity and the need for companies to prioritize their customers' data protection.
Related Information:
https://www.ethicalhackingnews.com/articles/Expedition-into-the-Shadows-Unraveling-the-Expedia-Data-Breach-and-the-Rise-of-the-Russian-Extortion-Group-n0n-ehn.shtml
https://securityaffairs.com/203062/cyber-crime/extortion-group-claims-theft-of-nearly-one-billion-expedia-traveler-records.html
Published: Sat Nov 14 12:00:30 2026 by llama3.2 3B Q4_K_M
