orbitz site

Orbitz and Expedia Reach $110,000 Settlement with Pennsylvania AG Over 2017 Data Breach

The travel companies were fined for lax data security practices that potentially led to a breach affecting 880,000 payment cards globally.

  • By Haley Samsel
  • Dec 17, 2019

Travel websites Orbitz and Expedia have reached a settlement with the Pennsylvania attorney general’s office that concludes an investigation into a 2018 data breach, state Attorney General Josh Shapiro announced Friday.

Orbitz disclosed in March 2018 that a breach may have compromised data for 20,755 Pennsylvania users and up to 880,000 payment cards across the globe. Expedia has owned Orbitz and its assets since a sale in September 2015, according to the attorney’s office.

Shapiro and his team have fined the companies $110,000, including an $80,000 civil penalty, as punishment for lax data security policies that did not adequately protect customer information.

As part of the settlement, Expedia and Orbitz committed to strengthening their cybersecurity practices, including implementing a comprehensive security program on Orbitz’s website. In addition, the companies must conduct an annual comprehensive risk assessment, reorganize its network to be more segmented, and deploy better access control and account management tools.

“Someone broke into Orbitz’ IT system and vacationed in what was supposed to be a safe place for travelers,” Shapiro said in a statement. “The breach showed the company’s promise to keep customer information secure was more like a leaky boat. We work every day to protect Pennsylvania consumers and to seek justice when any company misrepresents itself.”

Shapiro’s settlement follows in the footsteps of other attorneys general who have gone after companies for data breaches in recent years. In July, all 50 state attorneys general declared victory after reaching a $650 million settlement with Equifax, the consumer reporting agency that suffered a 2017 breach affecting 147 million customers.

Orbitz, which did not provide comment on the sesttlement, first began to investigate a breach in 2017 after discovering that an older website, which hosted its travel rewards redemption service, and the platform of an unnamed business partner were breached, according to Fortune. The stolen information included names, dates of birth, email addresses and street addresses in addition to payment card information.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Report: 47 Percent of Security Service Providers Are Not Yet Using AI or Automation Tools

    Trackforce, a provider of security workforce management platforms, today announced the launch of its 2025 Physical Security Operations Benchmark Report, an industry-first study that benchmarks both private security service providers and corporate security teams side by side. Based on a survey of over 300 security professionals across the globe, the report provides a comprehensive look at the state of physical security operations. Read Now

    • Guard Services

  • Identity Governance at the Crossroads of Complexity and Scale

    Modern enterprises are grappling with an increasing number of identities, both human and machine, across an ever-growing number of systems. They must also deal with increased operational demands, including faster onboarding, more scalable models, and tighter security enforcement. Navigating these ever-growing challenges with speed and accuracy requires a new approach to identity governance that is built for the future enterprise. Read Now

  • Eagle Eye Networks Launches AI Camera Gun Detection

    Eagle Eye Networks, a provider of cloud video surveillance, recently introduced Eagle Eye Gun Detection, a new layer of protection for schools and businesses that works with existing security cameras and infrastructure. Eagle Eye Networks is the first to build gun detection into its platform. Read Now

  • Report: AI is Supercharging Old-School Cybercriminal Tactics

    AI isn’t just transforming how we work. It’s reshaping how cybercriminals attack, with threat actors exploiting AI to mass produce malicious code loaders, steal browser credentials and accelerate cloud attacks, according to a new report from Elastic. Read Now

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

Most   Popular

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.