expediagroup.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting Expedia Group, with a high risk score of 100. The primary concerns are historical data breaches, accounting for 67.6% of events, and active infostealer logs at 32.4%. A total of 8,173 data breaches and 3,913 infostealer events were observed over the reporting period. The timeline shows a notable surge in employee and client-related events in January 2026, and again in March, April, May, and June 2026, suggesting a prolonged or escalating compromise. Malware families like LummaC2 and Rhadamanthys are prevalent, indicating potential credential harvesting and further compromise. The exposure primarily targets authentication services, specifically password-related endpoints on accounts.expediagroup.com, with 4,135 events related to password compromise. The geographical distribution shows a concentration of activity originating from India, the United States, and the Philippines. The presence of "Combolist sources" and "Database dumps" in leak repositories suggests that compromised credentials may have been obtained through brute-force attacks or the exploitation of previously breached databases. Remediation should focus on immediate credential rotation for affected users, enhanced monitoring of authentication logs, and a thorough investigation into the root cause of the data breaches and infostealer activity.