Orbitz orbitz.com Orbitz data breach: what happened and what to do
Orbitz said in March 2018 that a legacy travel platform may have been accessed between October and December 2017. About 880,000 payment cards could be affected, along with names, dates of birth, phone numbers and addresses.
View all 13,177 breaches- Breach date
- Oct 2017
- Data exposed
- Names, Credit cards, Dates of birth, Phone numbers, Email addresses, Physical addresses, Genders
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In March 2018, Orbitz, which is owned by Expedia, said an older Orbitz platform had likely been accessed by an attacker. The company found the problem while investigating a related issue on the Travelocity Partner Network, which ran in the same legacy environment.
Orbitz estimated that about 880,000 payment cards could have been exposed. Coverage of the notice says the platform held names, payment card data, dates of birth, phone numbers, email addresses, billing addresses and gender. Orbitz said it found no evidence of unauthorized access to passport or travel itinerary information, and said it did not collect Social Security numbers on that platform.
Orbitz also said it had no direct evidence that personal information was actually taken. Reports differ on the dates: one account describes access between October and December 2017, and another says purchase data from early 2016 and partner data from 2016 through December 2017 was on the platform. The state filings give October 1, 2017 as the breach date.
Card numbers with names and expiry details are what fraudsters need for card-not-present purchases. A date of birth, phone number and address together are the kind of details used in impersonation and phishing, including calls that pose as a travel company or your bank.
Orbitz offered one year of free credit monitoring and identity protection in the countries where it was available, and gave partners help notifying their own customers.
Sources checked: engadget.com, scworld.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Check card statements and report unfamiliar charges
Look through statements for the card you used and report any charge you don't recognize to your card issuer right away. Ask the issuer about replacing the card. The FTC lists next steps at https://www.identitytheft.gov/databreach.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls about this incident with suspicion. Don't click links in them. Go to the company's website directly, or call a number printed on your card or bill.
- 3
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts from being opened in your name. Place it with Equifax, Experian and TransUnion, as the FTC explains at https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts. Your date of birth, phone number and address were on the platform.
- 4
Replace the card if your issuer suggests it
If you booked on Orbitz around 2016 and 2017 with a card you still use, ask the issuer whether a replacement makes sense. Issuers can flag the old number and send a new one.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- Washington Attorney General , filed 20 Mar 2018 : 5,013 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Orbitz breach?
Orbitz said about 880,000 payment cards could be affected, tied to its legacy platform. If you booked through Orbitz or one of its partners around 2016 and 2017, check your notification and card statements.
What did the Orbitz breach expose?
Coverage of the notice lists names, payment card data, dates of birth, phone numbers, email addresses, billing and physical addresses and gender. Orbitz said passport and itinerary data showed no evidence of access.
Were Social Security numbers exposed?
Orbitz said it does not collect Social Security numbers on that platform.
Should I change my password?
The notice doesn't list passwords. It is still a good idea to use a unique password for your travel accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
