Booking a flight used to mean calling a travel agent. Now it means handing your name, address, date of birth, phone number, and sometimes a passport scan to a dozen different companies before you’ve even packed a bag. And according to new research, a lot of that data isn’t staying safe.
NordVPN and Saily reported that 119.4 million traveler records were exposed across 494 travel-related data breaches between January 2021 and August 2026. That’s not a rounding error. That’s roughly the population of Japan, all with their personal details sitting in breach databases.
The breach numbers are lopsided — and that matters
The raw total is striking, but the year-by-year breakdown tells a more complicated story. In 2021, researchers found more than 37.4 million exposed records spread across 278 separate breaches. That’s the highest incident count in the dataset. By 2023, the number of breaches had dropped to just 23 — but those incidents still exposed nearly 30 million records.
So fewer breaches doesn’t mean less damage. A handful of large incidents can expose as many people as hundreds of smaller ones. For travelers, both patterns are a problem. Frequent small breaches mean your data is constantly at risk from minor platforms. But one big airline or hotel breach can compromise millions of records overnight.
Which travel sectors leak the most data
The research grouped affected companies into five categories. Here’s how the share of exposed records broke down:
- Car rental, cruise, and rail companies: 27.7% of exposed records
- Booking platforms, online travel agencies, tours, and activity providers: 24.6%
- Hotels and resorts: 23.7%
- Airlines: 21.2%
- Loyalty and rewards programs: 2.8%
Booking platforms and online travel agencies had the most breach incidents by far, at 274 out of 494 total. But airlines had the biggest individual incidents. Just 21 airline breaches exposed over 25 million records. The average airline breach contained around 1.2 million records, compared to roughly 107,000 for booking platforms. Airlines hold more data per customer and attract higher-value attacks as a result.
It’s not just passwords being exposed
Every breach in the dataset contained email addresses, since unique emails were used to measure breach size. But the exposed data went well beyond login credentials. Full names appeared in 92% of breaches, phone numbers in 87%, home addresses in 78%, dates of birth in 55%, and government ID information in 11%.
That’s the part that should worry people most. You can change a password. You cannot change your date of birth, your nationality, or your passport number. Travel data is sticky in a way that financial breach data sometimes isn’t.
The forgotten account problem
There’s a less obvious risk buried in the data. Booking platforms, tour operators, and activity providers accounted for more than half of all breaches analyzed. Many of those services are used once, for a single trip, and then forgotten entirely. But forgotten doesn’t mean deleted. Those old accounts may still hold your personal details years later, sitting quietly until the company gets breached.
The researchers suggest a few practical steps: use guest checkout when possible, apply unique passwords and multi-factor authentication to every travel account, delete stored payment methods after a booking is complete, and periodically go back and close old accounts you no longer use. None of that is complicated. Most people just don’t do it.
The travel industry has a data minimization problem. Companies collect more than they need, keep it longer than necessary, and face breaches at a rate that should make every traveler more cautious about what they hand over at checkout.