(Reuters) – Orbitz, a subsidiary of online travel agency Expedia Inc
The unit said an investigation showed that the breach may have occurred between Jan. 1, 2016 and Dec. 22, 2017 for its partner platform and between Jan. 1, 2016 and June 22, 2016 for its consumer platform.
Information such as names, phone numbers, email and billing addresses may have been accessed, the travel website operator said, adding that its website, Orbitz.com, was not impacted.
“To date, we do not have direct evidence that this personal information was actually taken from the platform and there has been no evidence of access to other types of personal information, including passport and travel itinerary information,” Orbitz said.
For U.S. customers, social security numbers were not involved in this incident, the company said.
The company said it has addressed the breach after it was discovered in March this year.
Credit card issuer American Express Co
The breach is the latest in the travel sector and follows attacks on global hotel chain InterContinental Hotels Group Plc
Expedia’s shares fell as much as 1.9 percent to $108.99.
(Reporting by Vibhuti Sharma in Bengaluru; Editing by Anil D’Silva and Sriraj Kalluvila)