The ransomware group N0n has listed Expedia Group on its leak site, claiming a major breach of the travel giant, according to threat intelligence reports published on Monday. The claim has not been independently verified, and Expedia has not confirmed any intrusion.

The listing, discovered at 00:52 UTC on 9 November and marked as not paid and exposed, describes a vast haul: loyalty programme account tables holding 830,069,282 rows across 800 files, a traveller profile table of 58,380,209 rows, and a consumer account and credential archive of 333,298,275 rows pairing traveller accounts with email addresses and password-like tokens. It also claims live credentials for Expedia's big data platform, including source code access tokens for 19,935 private repositories and live production cloud access, plus booking records, Vrbo reservation and payment records, and a workforce planning database backup dated 21 October 2026.

Threat intelligence analysts caution that a leak-site listing alone does not prove a successful attack. ThreatMon, which first flagged the listing, notes that the available report provides no evidence of the alleged intrusion, no stolen data samples, and no ransom demand, and that neither listing independently confirms that customer information was stolen.

N0n is one of the most active ransomware groups currently tracked, with 116 victims listed since September 2026. The group typically follows a double-extortion model, exfiltrating data before encrypting systems so victims face demands for both decryption and non-disclosure.