Orbitz Discloses Possible Data Breach Affecting 880,000 Payment Cards--Update

By Imani Moise 

Expedia Inc.'s Orbitz subsidiary said Tuesday it has discovered a possible data breach affecting thousands of customers on one of its older sites and a partner platform.

Orbitz didn't disclose which partner platform was affected by the breach, but American Express said in a separate release Tuesday that travel booked through its representatives and through Amextravel.com had been affected by the cyber attack.

The breach is estimated to have affected about 880,000 payment cards, Orbitz said.

The travel-booking site operator said that during an investigation of an older Orbitz platform it found that a hacker may have accessed consumer data late last year and it is working to notify those who may be affected. The breach didn't affect the new Orbitz.com, the company said.

The hacker could have had access to data on purchases made between January 2016 and December of last year, including birthdays, addresses, full names and payment card information.

The company said that so far there is no evidence that passport or travel itinerary information were accessed and that it doesn't keep Social Security information on U.S. customers on its platform.

American Express said American Express Global Business Travel and the platforms that manage credit-card accounts weren't impacted by the attack.

It is unclear if any of the data was taken from the platform.

The companies are offering those affected by the breach free credit monitoring.

Orbitz's disclosure is the latest announcement from a company involving a breach of sensitive consumer data. Lawmakers have begun to push for tighter regulations regarding when companies have to report potential hacks following incidents at Amazon.com Inc.'s Whole Foods Market, Sonic Corp. and Equifax Inc. last year.

Expedia shares fell 2.1% to $108.81 during afternoon trading.

Write to Imani Moise at [e-mail]

(END) Dow Jones Newswires

March 20, 2018 14:47 ET (18:47 GMT)

Copyright (c) 2018 Dow Jones & Company, Inc.