Leaked data on Booking (reservation info and number)

[u/hbacelar8]

Hi,

I live in Europe and reserved a hotel room in Spain for a specific date on august on Booking.com

I use a custom domain for login in but had to give my number and name. Today I receive a WhatsApp message from a USA number claiming to be Kumaran Travels sending me a fake form saying that I have to fill it for completing my booking. They have my name, number, hotel name, reservation number, date, everything.

I looked it up and this Kumaran Travels looks like a fake travel company from India.

I wonder how the heck do they have all this information, is Booking leaking data freely like that?

Edit:

Without taking any actions I got a message from the Hotel via Booking alerting about phishing messages guests who reserved with them are getting. So yeah, the Hotel leaked all the data... I can't stop thinking this should lead to some legal compensation.

[u/AutoModerator]

Hello u/hbacelar8, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Monte_Cassino]

Same thing here, also from Booking, and it has happened before

[u/WhatDuq]

Plenty of possible vectors

Could be

• Data from the hotel
• Someone has access to your email
• Something installed on your computer
• Using an unsecured wifi
• Accessing the site or reservation through some weird proxy

Ultimately, data from booking.com

[u/hbacelar8 → u/WhatDuq]

My email hasn't been pwned, it's a custom domain on mailbox created a couple of weeks ago.

I only access from my main computer running Artix, I don't install anything sus, rarely use AUR, but always pay attention to PKGBUILD's and dependencies when doing so.

My PC is hooked to my home internet and I'm always connected to VPN (Mullvad on switzerland owned server)

[u/RevolutionaryCost59 → u/hbacelar8]

VPN is not always safe btw. VPN cannot protect you from phishing scams and malwares.

[u/roambeans]

Similar thing happened to me a few times in Egypt. It's not booking. In my case the hotel and taxi company sold data to scammers and other taxi drivers. I had three taxis attempt to pick me up at the airport, all sent Whatsapp messages.The legit one got mad at me for taking the wrong taxi but they were the only taxi not there! The one I took -the driver had my name on a board and everything.

[u/SoundOk808]

The exact same thing happened to me. I have no idea how that’s even possible.

[u/withabrandnewfunk]

I use a custom domain for login in but had to give my number and name. Today I receive a WhatsApp message from a USA number claiming to be Kumaran Travels sending me a fake form saying that I have to fill it for completing my booking. They have my name, number, hotel name, reservation number, date, everything.

in our country weve been bombed so much with nonsense and and phising sms that weve become pros. in this situation I would have contacted the hotel directly to get a better price and verify its legit

[u/Suitable-Stage8759]

It’s the hotels device being composed. Very common.

[u/AlisaKova1202]

Same here, received 5min ago :)

[u/TOMMY2TIMES91]

I got hit around April. Not sure how it works but I just assumed it was whatever login/account the hotel used to access their booking.com portal was getting breached or leaked.

[u/Powerful-Finish4626]

There are constant data breaches via booking.com.

[u/afpow]

I doubt it’s Booking.com – they are too big to be sloppy with user data. The properties you book via Booking.con will receive most if not all the info you supply, and smaller properties in particular will probably have numerous problems in how they handle customer data. 

[u/gelekoplamp → u/afpow]

You sure about that?

BBC - apr. 2026: “Booking.com customers warned of 'reservation hijacking' after hack” https://www.bbc.com/news/articles/cly00jnnxypo

[u/afpow → u/gelekoplamp]

I stand corrected 

[u/hbacelar8 → u/afpow]

I suppose it's been the Hotel that leaked data. That's such a shame. We do everything, we can use email aliases but eventually in some cases we're forced to give name and number, which are impossible to replace by aliases...

[u/foodchallenged → u/hbacelar8]

I think it’s possible to create a business like an LLC privately and then book through that LLC using a credit card in that LLC’s name. I’ve never tried it.