Possible Orbitz Data Breach Might Affect 88K Credit Cards

CHICAGO, IL — Orbitz has discovered evidence of a possible data breach affecting about 88,000 credit cards, the Chicago-based travel website announced this week. So far, the company is unsure if any personal information was taken in the online attack. Orbitz website was not involved any way with the breach, the company said.

The hack was found March 1, and it happened to one of the company's legacy travel booking sites between Oct. 1 and Dec. 22, Orbitz said. Personal information the online attacker might have accessed would have come from certain purchases made between Jan. 1, 2016, and June 22, 2016. Orbitz partner platform data submitted between Jan. 1, 2016, and Dec. 22, 2017, also might have been hacked, according to the company.

"We took immediate steps to investigate the incident and enhance security and monitoring of the affected platform," Orbitz said in a statement released Tuesday. "As part of our investigation and remediation work, we brought in a leading third party forensic investigation firm and other cybersecurity experts, began working with law enforcement, and took swift action to eliminate and prevent unauthorized access to the platform."

Information that might have been accessed in the breach included customers' full names, payment card info, date of birth, phone number, email address, physical and/or billing address, and gender, Orbitz said. Passport and travel itinerary information does not appear to have been accessed, and Social Security numbers were not compromised, the company said.

Orbitz, which is owned by Expedia, is currently notifying its customers and partners about any personal information that might have been accessed in the breach. The travel website is offering affected customers a year of complimentary credit monitoring and identity protection service. It's also providing its business partners with complimentary customer notice support so they can inform their customers, if necessary.

"Ensuring the safety and security of the personal data of our customers and our partners’ customers is very important to us," Orbitz said in the statement. "We deeply regret the incident, and we are committed to doing everything we can to maintain the trust of our customers and partners."

Customers are urged to monitor their credit card statements for any unusual information. Any Oribitz customers with questions can call the company at 855-828-3959 from 8 a.m. to 8 p.m. Monday through Saturday. They also can go to a page devoted to the breach on Orbitz's website.

Photo Illustration by Joe Raedle | Getty Images News | Getty Images