Expedia subsidiary Orbitz today revealed hackers may have accessed personal information from about 880,000 payment cards.
The business said an investigation showed that the breach may have occurred between Jan. 1, 2016 and Dec. 22, 2017 for its partner platform, and between Jan. 1, 2016 and June 22, 2016 for its consumer platform.
Information such as names, phone numbers, email and billing addresses may have been accessed, the travel website operator said.
It said its website, Orbitz.com, was not impacted.
“To date, we do not have direct evidence that this personal information was actually taken from the platform and there has been no evidence of access to other types of personal information, including passport and travel itinerary information,” Orbitz said.
The company said it has addressed the breach after it was discovered in March this year.
Credit card issuer American Express said in a statement that the attack did not compromise its platforms.
The breach is the latest in the travel sector and follows attacks on global hotel chain InterContinental Hotels and Hyatt Hotels last year.
Expedia’s shares fell as much as 1.9 percent to US$108.99 following the announcement.
