New Booking.com data breach forces reservation PIN resets

It has been reported that Booking.com has forced users to reset reservation PINs after a new data breach that affected parts of its systems. The move came after unusual activity was detected around reservation management tools, prompting the online travel agency to invalidate existing PINs as a precaution. Customers were reportedly notified and asked to create fresh PINs to access and modify bookings.

What happened — short and sharp

According to BleepingComputer, the incident did not immediately appear to involve full account takeovers, but some booking details and access controls were potentially exposed. It has been reported that the company moved quickly to lock down affected systems and push mandatory PIN resets while it investigates. Allegedly, the disruption is limited in scope; however, the lack of full public detail has left travelers worried and annoyed.

What you should do

If you have a Booking.com reservation, check your email and the app for a reset prompt and change any affected reservation PINs right away. Also review recent bookings for unexpected changes and consider changing passwords tied to the same email, especially if you reuse credentials elsewhere. Keep an eye on official Booking.com communications for more precise guidance and any potential notifications about compromised personal data.

Why it matters

Travel is a people business — and trust is everything. A forced reset is more than a nuisance; it’s a reminder that guest data remains a juicy target for attackers. This incident joins a string of breaches hitting travel companies in recent years, underscoring the industry's ongoing security challenge. Who wants to worry about cyberattacks when planning a getaway? Not many. Booking.com’s response will be watched closely — customers want assurance, not just a reset link.

Sources: bleepingcomputer