About 120 Million Traveler Records Exposed on the Dark Web
TECHWORLD ·
✦ AI Summary
NordVPN and Saily, together with NordLayer Intelligence researchers, analyzed travel-related data breach cases confirmed between January 1, 2021, and August 18, 2026.
As a result, 494 data breaches were identified across the travel industry, and about 119.4 million records of travelers' personal information held by travel-related companies were exposed on the dark web.
By industry, booking platforms, online travel agencies, and tour and activity companies accounted for the largest share of breaches at 55.5%, while airlines had fewer incidents but an average exposure of about 1.2 million records per case.
NordVPN, together with the global eSIM service Saily, investigated travel-related data breaches. The analysis was conducted by researchers at NordLayer Intelligence.
The researchers analyzed travel-related data breach cases confirmed between January 1, 2021, and August 18, 2026. As a result, 494 data breaches were identified across the travel industry.
The breaches were widespread across multiple sectors, including airlines, hotels, booking platforms, tour and activity companies, car rental firms, cruise operators, and rail services. According to NordVPN's findings, about 119.4 million records of travelers' personal information held by travel-related companies were exposed on the dark web.
The exposed information included names in 92% of cases, phone numbers in 87%, addresses in 78%, dates of birth in 55%, passwords in 46%, nationalities in 19%, and government-issued identification information in 11%. The findings showed that a wide range of personal data was exposed, from basic contact information and addresses to passwords and government-issued ID information.
The study pointed out that structural risks exist in the travel industry because personal data is passed on to multiple businesses during the use of travel services and may remain stored in the systems of service providers even after a trip ends. It said the scope of data sharing spans multiple companies involved in flights, lodging, tours, activities, and car rentals.
By industry, breaches at booking platforms, online travel agencies (OTAs), and tour and activity companies accounted for 55.5% of the total, the largest share. The study's focus was on the structural risks facing the travel industry.
The study found that many small travel agencies and local experience service providers use older or poorly managed platforms. As a result, it said those companies' security vulnerabilities are more easily exposed.
Airlines, by contrast, showed a lower frequency of breaches. However, when an incident did occur, the scale of the damage was significant.
There were 21 airline-related breaches in total. The average exposure per airline incident was about 1.2 million records, more than 11 times the roughly 107,000 records seen in booking platform and tour-related cases.
Comparing the total exposed records by industry, car rental, cruise, and rail services accounted for the largest share at 27.7%. Booking and tour-related companies followed in second place with 24.6%, hotels and resorts ranked third with 23.7%, and airlines came fourth with 21.2%.
Against this backdrop, NordVPN urged travelers to manage their personal information carefully. NordVPN advised users to avoid creating unnecessary travel-related accounts, use unique passwords for each service, and enable multi-factor authentication, noting that information is shared with multiple companies during the travel process. It also recommended checking whether it is truly necessary to upload passport or ID copies and deleting payment and identity information that is stored longer than needed.
Marius Brieḍis, CTO of NordVPN, said travel is a highly connected ecosystem and that each company sharing information can become a potential point of data breach. He said passwords can be changed after a breach, but identity information such as names and dates of birth generally cannot be changed. He added that breaches at small companies are also risky, and that a single incident at a large airline can expose the information of millions of people.
Vykintas Maknickas, CEO of Saily, noted that a traveler's use of a service is temporary, but the relationship between the service and the traveler's data may not be. He explained that information shared with an activity website used just once can remain in a provider's system for years, and recommended deleting accounts that are no longer used after a trip and requesting that service providers erase personal data to reduce the amount of information left unnecessarily behind.
Source: TECHWORLD · Lee Gwang-jae
Original: https://www.epnc.co.kr/news/articleView.html?idxno=408090
References
This article was produced with the help of an automated content generation algorithm.
Source: TECHWORLD
View originalThis article was summarized and organized by BizCrush based on the original article from TECHWORLD. For exact quotations and full details, please refer to the original article.