Expedia named in n0n extortion claim

The extortion group n0n included Expedia Group, Inc. in a claim that has been logged by several ransomware trackers, but no public independent evidence has confirmed a breach at the company. The most cited figure refers to 830,069,282 records tied to loyalty programs, along with other datasets, though that information has not been officially verified.

What is known about the claim?

The verifiable point is the post attributed to n0n, which named Expedia Group, a U.S. travel and loyalty programs company, as a claimed victim. RansomLook recorded the entry and classified it as a U.S. organization, while Ransomware.live lists it as associated with the N0n group with a date of November 9, 2026. In both cases, the records function as claim aggregators, not technical validation of the incident.

What data is circulating, and why is it still in doubt?

CyPro said the material attributed to the group would include roughly 830 million loyalty program records spread across 800 files, plus other sets of traveler, booking, and account data. HookPhish narrowed the alleged scope further, putting it at 830,069,282 loyalty program records in 800 files, 58,380,209 traveler profiles, and 333,298,275 account and credential records.

The same source also attributes to n0n the alleged exposure of booking records, travel data, payment information, and access to cloud environments, including a source code access token and production cloud access. Even so, HookPhish said it did not show verifiable samples or official confirmation, and CyPro noted that no evidence was published showing that the data actually existed or was in the group's possession.

What did Jedi-Sec add?

Jedi-Sec repeated a similar inventory of the alleged material and added storage figures that remain tied to n0n's claim. According to that report, there would be about 747 GB across 582 storage locations and a 174 GB backup dated October 21, 2026. That reference also does not amount to independent confirmation of the intrusion or the authenticity of the data.

At this point, the only confirmed fact is that Expedia Group appeared in extortion posts and aggregators linked to n0n. The existence of a breach, the scale of the material, and the real source of the data remain without independent public proof.