Booking.com Security Failure Exposed Guest Data and Led to Fraud
We made a hotel reservation through Booking.com in my wife’s name for Hotel Amano Covent Garden in London, for the dates December 26–30. On December 5, we were contacted via WhatsApp by individuals who knew the exact hotel name, city, check-in and check-out dates, and my wife’s personal details. These individuals introduced themselves as Booking.com or hotel representatives, redirected us to a fake Booking.com page, and through this method, $1,400 USD was charged to my credit card without my authorization.
When we reported the situation to both Booking.com and the hotel, the hotel management admitted that customer data had been compromised as a result of a cyberattack. Despite this, neither Booking.com nor Hotel Amano Covent Garden provided any notification or warning regarding the data breach. Had reservation holders been warned in advance about leaked data, fake messages, and fraudulent payment requests, this financial loss could have been avoided.
Protecting personal data and notifying users of data breaches in a timely, clear, and transparent manner is both a legal obligation and a fundamental requirement for user security. Due to this negligence, I suffered a significant financial loss, and our trust in Booking.com and its partner hotel regarding data security has been seriously undermined. This incident clearly demonstrates that Booking.com does not adequately audit or enforce sufficient data security measures with its partner properties.
I request that Booking.com provide a formal and transparent explanation regarding this data breach, compensate my $1,400 USD financial loss resulting from the unauthorized charge, and ensure that users are promptly and clearly informed in the event of any future data breaches to prevent similar incidents. Otherwise, with my wife’s knowledge and consent, I state that I will pursue all available legal remedies.
Note: The reservation was made in my wife’s name, but the credit card that was charged belongs to me. This complaint is being submitted by me with my wife’s full knowledge and consent.
