The n0n cyber extortion group may be a relatively new actor on the ransomware scene, but it’s been making some massive hacking claims since it first emerged in September.
And one of those massive claims could well be a potential compromise of travel website Expedia.
n0n claimed to have stolen more than one terabyte of data from the company in a 3 November leak post, with customer data the bulk of the cyber criminals’ alleged haul.
“Loyalty program account tables: 830,069,282 rows across 800 files, holding consumer email addresses, member identifiers, point balances in 21 currencies, tier names and booking values across 35 named programs,” reads just the first of 12 bullet points outlining the allegedly compromised data.
n0n also claims to have more than 58 million rows of traveller profile data, details of more than 22 million journeys, credit expenditure details, household identifiers, almost 500,000 guest communication records, and a workforce planning database.
The group provided no evidence at the time; however, the alleged dataset has now been published on the dark web. The data appears to be an extract of the complete data that n0n claims to have; nonetheless, the compressed archive contains 11 folders of documents listing hundreds of thousands of email addresses linked to travel data, including log-in details, hotel stays and communications, and loyalty program details such as Traveller User IDs and points totals.
While several of the emails have appeared in previous data breaches, according to Have I Been Pwned, many others have never appeared in prior breaches.
The data may be historical in nature, given the date ranges in several of the files; Expedia, however, has declined to comment on the hackers’ claims.
n0n’s only Australian victim to date was Hunter Neurology, which confirmed it was investigating a possible third-party data incident in October.
Who is n0n?
While some threat intelligence analysts were unsure of the veracity of n0n’s hacking claims, many are now recognising that while the group may not be a traditional ransomware operator, it nonetheless remains a serious emerging threat.
The group claimed 204 victims in October, and already in November, it has listed more than 100 more victims, although many remain unnamed and are listed only as a number on its darknet leak site.
While n0n is clearly dangerous, its own security appears to be rather lax, according to research by cyber security firm SOCRadar.
“In September 2026, the SOCRadar Threat Research Unit discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware group,” the company said in a 28 October blog post.
“The open directory exposed the operation’s full September workflow: breach and exfiltration tooling, original locker source code, extortion infrastructure, and an AI coding agent environment backed by more than US$7,000 in paid LLM API usage.”
According to SOCRadar, the group’s activity focuses more on compromised credentials rather than exploiting known vulnerabilities.
“Every documented n0n intrusion relied on weak or compromised credentials, and no exploit payloads or CVE references were found in the operator’s files,” SOCRadar said.
“Entry points include credential stuffing against FortiGate SSL-VPN portals through residential proxies, weak RDP/WinRM credentials, exposed AWS IAM keys and reused hosting provider sessions.”
Who is Expedia?
Expedia is a part of the Expedia Group, which consists of Expedia, Hotels.com, Vrbo, Travelocity, Hotwire.com, Orbitz, Ebookers, CheapTickets, CarRentals.com, Expedia Cruises, Wotif, and Trivago.
Expedia operates more than 200 travel websites and has 19.3 per cent market share in the United States.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
