What the research tells us about travel data breaches
A trip can put your personal information in more places than you might realize. Airlines and hotels are the obvious ones, but booking sites, rental companies, rail operators, loyalty programs, tour providers, and smaller services all gather details of their own along the way.
NordVPN and Saily researchers looked at travel-related breaches observed between January 2021 and August 2026 to see what happens to that data when travel companies are breached.
The researchers found 119.4 million exposed traveler records, but the total is only part of the story. The study revealed two very different patterns — some types of travel companies appeared in breaches much more often, while others had fewer incidents with far more people affected at once.
The data being exposed also wasn’t limited to account credentials. Travel breaches frequently contained personal details that are difficult, or sometimes impossible, to change.
So where are the weak spots, and what information are travelers leaving behind? Let’s look at the findings.
Travel data breaches don’t follow a steady pattern
The researchers observed 119,433,433 exposed traveler records across the period analyzed. However, those records were far from evenly distributed among the years.
In 2021 alone, the researchers identified more than 37.4 million records across 278 breaches — the highest incident count in the dataset, driven largely by a cluster of smaller booking platform leaks. In 2022, the number of incidents dropped substantially to 43, but those breaches still exposed almost 22 million records. The following year brought only 23 observed breaches but nearly 30 million exposed records.
A high breach count doesn’t always mean more exposed records. The 2021 dataset contained more than 12 times as many breaches as 2023, but only around 25% more exposed records. A few very large leaks can quickly tip the balance.
For travelers, both sides of the equation count. A sector can have frequent, smaller breaches or occasional incidents that affect millions of people in one hit.
The most affected travel sectors
A data breach at a small tour operator looks very different from one at a major airline. The first may affect fewer customers but be one of many similar incidents, while the second can expose information belonging to a huge number of travelers at once.
To account for these differences, the researchers grouped the affected companies into five travel sectors:
- airlines
- hotels and resorts
- loyalty and rewards programs
- booking platforms, online travel agencies (OTAs), tours, and activity providers
- car rental, cruise, and rail companies
Car rental, cruise, and rail companies accounted for the largest share of observed exposed records, at 27.7%. Booking platforms, OTAs, tours, and activity providers followed closely at 24.6%, with hotels and resorts at 23.7% and airlines at 21.2%. Loyalty and rewards programs accounted for the remaining 2.8%.
Booking platforms, OTAs, tour operators, and activity providers were the most frequently breached category in the research, accounting for 274 incidents. This group includes businesses of very different sizes, from large booking sites to small agencies, regional tour operators, and activity providers.
Airlines showed the opposite pattern. Researchers observed only 21 airline breaches, compared with 274 in the booking, OTA, tour, and activity category. But those 21 incidents exposed more than 25.2 million records. An average airline breach contained around 1.2 million records — more than 11 times the roughly 107,000-record average for booking, OTA, tour, and activity providers.
What information is exposed in travel data breaches?
Every breach analyzed for the research contained email addresses because unique exposed email addresses were used to measure breach size. But most incidents also included other personal information.
Full names appeared in 92% of the analyzed breaches, phone numbers in 87%, and addresses in 78%. More than half included dates of birth (55%) and gender information (53%), while 46% contained passwords. Nationality appeared in 19% of breaches, and government ID information in 11%.
Together, these details can build a precise picture of a person. Someone who gains access to breached travel data could know your full name, where you live, how to contact you, and when you were born. Depending on the provider and breach, the exposed information could also include nationality or identification details.
Travel data can be particularly sensitive because much of it is difficult to change. You can reset a compromised password, but you can’t change your date of birth or other personally identifiable information.
Your data may outlive your trip
The research also points to a less obvious problem: Travelers may still have personal data stored with companies they used once and have since forgotten about. Booking platforms, OTAs, tour operators, and activity providers accounted for more than half of the breaches analyzed, and many of these services may only be needed for a single trip.
You might remember the airline you flew with five years ago, but probably not every local tour company, car rental service, or booking site you used. Depending on the company’s policies and legal requirements, those services may retain customer information after the trip ends. An old account you barely remember could therefore still contain personal details if the company is breached years later.
How to share less personal data when traveling
Travelers can’t control how every airline, hotel, or booking service protects its infrastructure. But they can be more selective about what they hand over. A few simple habits can help you leave less sensitive information behind:
- Avoid creating unnecessary accounts. Before creating an account, consider whether you actually need one or whether the service allows you to complete the booking using guest checkout.
- Use unique passwords and multi-factor authentication (MFA). A unique password for each account means credentials exposed by one provider can’t be reused elsewhere. MFA adds another check, making it harder to access your account with a stolen password alone.
- Remove saved personal information. Delete stored payment methods and identity documents once the service no longer needs them.
- Be careful when uploading IDs. Passports and other government-issued IDs are sometimes required, but don’t upload identification just because a form asks for it. Check why the company needs the document, how it will use it, and whether you can provide the necessary information another way.
- Review old travel accounts. Delete travel accounts you no longer need and, where appropriate, request deletion of the personal data associated with them.
- Be cautious. Treat unexpected emails or messages about past bookings with suspicion, especially if they ask you to log in, share information, or make a payment.
Online security starts with a click.
Stay safe with the world’s leading VPN
Methodology
NordVPN and Saily researchers analyzed historical breach data from January 1, 2021, to August 18, 2026, using data available through the NordLayer Intelligence threat exposure management platform.
The researchers reviewed the breach catalog for the analyzed period and classified incidents involving airlines, hotels and resorts, online travel agencies, tour and activity providers, loyalty programs, and car rental, cruise, and rail companies. Each breach was categorized based on the affected organization’s name, domain, and description. Researchers individually verified the largest incidents and removed false positives.
Breach size was measured using the number of unique exposed email addresses. The final dataset contained 119,433,433 traveler records across 494 travel-related breaches.
The findings represent incidents observed in the analyzed dataset and should not be interpreted as the complete global number of travel-sector data breaches or exposed traveler records.
