Expedia Inc.-owned Orbitz said hackers may have accessed 880,000 credit-card numbers used to book travel through the site and other companies serviced by Orbitz, including American Express Co.
The news pushed Expedia shares down 1.5 percent to $109.63 at 2:31 p.m. in New York. In addition to the cards, hackers may have stolen names, dates of birth, phone numbers and addresses of consumers who booked through Orbitz in 2016 and 2017. Orbitz also provides a back-end booking system for other companies, which may also have been affected, Orbitz said in an email. American Express said that could include people who booked through Amextravel.com.
The hack is the latest headache for Expedia stemming from its $1.6 billion acquisition of Orbitz in 2015, a deal that cemented the company’s position as one of two global travel-booking giants, along with Booking Holdings Inc. While Expedia was integrating Orbitz’ back-end system with its own, the network crashed, causing downtime that affected sales enough to cut into quarterly revenue, the company said in July 2016.
Expedia shares have declined more than 8 percent this year as extra spending on improving its HomeAway short-term rental site and marketing its various brands around the world eats into profit. The company is fending off a renewed push from Booking Holdings to market its Booking.com website in the U.S., Expedia’s home turf. Alphabet Inc.’s Google also is taking market share with its hotel search product, and Airbnb Inc. is setting a high bar to meet in terms of what customers expect for home-sharing services like HomeAway.