Agoda

On May 6, 2026, threat intelligence researchers discovered 82 million Agoda customer records advertised for sale on dark web marketplaces. The dataset included full names, email addresses, phone numbers, national identification numbers, physical addresses, and booking metadata from Agoda's customer database. The seller identity remains unknown, and no ransomware group has publicly claimed responsibility.

82 million customer records containing full names, email addresses, phone numbers, national identification numbers, physical addresses, and booking metadata. This is the complete customer profile from a travel booking platform—everything needed to impersonate travelers, reconstruct travel patterns, or target individuals based on their international movement.

National ID numbers represent the most damaging component. Unlike passwords that can be changed or credit cards that can be canceled, national identification numbers are permanent. They're used for financial transactions, government services, employment verification, and identity authentication across entire countries. Once compromised, they enable identity theft that persists for years.

Agoda operates across Asia-Pacific with strong presence in Thailand, Japan, South Korea, and Southeast Asia. Those 82 million records represent international travelers—people who cross borders, hold passports, maintain hotel loyalty programs, and leave digital footprints across countries. Booking metadata reveals travel patterns, preferred destinations, spending habits, and companion travelers.

National ID exposure creates permanent risk. Attackers can open financial accounts, file fraudulent tax returns, apply for government benefits, or bypass identity verification systems using legitimate government identification numbers. For international travelers, the exposure extends across borders—ID numbers from one country used to commit fraud in another, making investigation and prosecution nearly impossible.

Agoda operates under Booking Holdings, a publicly traded company subject to GDPR, PCI DSS, and multiple international data protection regulations. They maintain compliance certifications, security audits, and enterprise security infrastructure expected of a global travel platform processing millions of transactions.

They believed their customer database was secured through access controls, encryption, and monitoring systems. Hotels and airlines trust Agoda with customer payment information and personal data. Corporate customers book business travel through their platform. The security posture was designed to meet the requirements of handling sensitive financial and personal data across international jurisdictions.

Travel platforms accumulate customer data across years of bookings. Every reservation, every cancellation, every customer service interaction adds another data point to customer profiles. Over time, the database grows to contain not just current bookings but historical travel patterns, payment methods, companion travelers, and preference profiles.

The presence of national ID numbers in 82 million records suggests collection without adequate classification. Why were national IDs stored in the customer database? Which jurisdictions required them? Were they encrypted separately from other fields? Did Agoda know exactly how many national ID numbers existed in their systems before attackers extracted them? The gap between regulatory compliance and actual data inventory becomes visible only after breach disclosure.

The data appeared on dark web marketplaces without ransomware demands or public claims. No threat group took credit. No leak site announcement preceded the sale. The attacker simply extracted 82 million records and monetized them directly. For Agoda, this means no negotiation window, no opportunity to contain the breach before public disclosure, and no clear timeline for when the intrusion occurred.

Notification requirements span every country where those 82 million customers reside. GDPR in Europe. PDPA in Thailand and Singapore. APPI in Japan. Dozens of different data protection authorities, each with their own notification deadlines and penalty frameworks. Booking Holdings faces potential regulatory action across multiple jurisdictions simultaneously while customers discover their national ID numbers are for sale online.