Orbitz (Expedia Group)

The 2018 Orbitz breach remains the useful precedent because of what it exposed: a legacy booking platform Expedia had acquired, still running, still holding customer payment and travel data. Acquisitions inherit systems, and old systems that no longer receive engineering attention are where breaches live. A consumer booking through a familiar brand has no way to know whether the platform behind it is actively maintained or a legacy asset kept alive for the traffic.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — governed by Expedia Group's overall terms given common ownership (see Expedia row, Consumer Apps tab).

Data sharing

HISTORICAL CONFIRMED BREACH (2018, still relevant precedent): Orbitz (owned by Expedia Group) disclosed a breach potentially affecting 880,000 payment cards used on an older Orbitz platform between 2016-2017 — Orbitz offered affected customers free credit monitoring. No more recent (2025-2026) Orbitz-specific incident independently confirmed this pass.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.