Booking.com Hacked — Attackers Obtain Personal Data of Thousands of Travelers

Booking.com in the hands of hackers. 78 million records from GTA on a leak site. A Microsoft Defender that opens doors instead of guarding them. And OpenAI losing nearly all its macOS certificates because of a single npm package. Welcome to Security Sunday.

Booking.com has confirmed a large-scale security incident in which attackers gained access to customer reservation data.

According to official statements, the attackers obtained names, email addresses, phone numbers, reservation details, and even private communications between guests and accommodation providers. Payment information and credit card numbers were, fortunately, not compromised, according to the company.

The company responded immediately. It reset the PIN codes for all affected reservations and notified impacted users by email.

The exact number of victims, however, has not been disclosed. Booking has only repeatedly assured that every affected customer will be contacted individually.

This is not the first incident in the company’s history. In 2021, Dutch regulators imposed a fine of €475,000 for a leak of personal data affecting more than 4,000 Booking.com customers.

Dubai-based cybersecurity firm Hackmanac reports that responsibility for the attack has been claimed by a hacker group called Vect, which has allegedly also breached Airbnb. These claims have not yet been confirmed.

One thing worth flagging: the risk of phishing attacks. Armed with specific reservation details (hotel names, stay dates, booking numbers), attackers can make phishing attempts exceptionally convincing.

Are You Sure Your Systems Are Secure?

Every week we cover attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’d be glad to help you find out. At SysNetShield, we offer vulnerability scanning, penetration testing, Red Teaming, and simulated phishing campaigns.

Write to us at **team@sysnetshield.com **the first consultation is free.

Rockstar Games Falls Victim to Data Breach — ShinyHunters Leak 78.6 Million Records

Staying on the topic of data breaches: Rockstar Games, best known for the legendary Grand Theft Auto series, has become the victim of a large-scale leak. The extortion group ShinyHunters published over 78.6 million records on its leak site, allegedly taken from the studio’s internal analytics systems. Rockstar itself confirmed the incident in a statement to Kotaku, though it described the leak as only “a limited amount of non-essential corporate information.”

The way the attackers obtained the data deserves particular attention. They did not manage to break into Rockstar’s infrastructure directly. Instead, they exploited a compromise of the analytics platform Anodot. Using stolen authentication tokens, they gained access to Snowflake, which the studio uses for its operational metrics. A Snowflake spokesperson confirmed that, upon detecting suspicious activity, it proactively blocked all user accounts linked to Anodot. This type of supply-chain attack has become increasingly common in recent years and shows just how heavily companies rely on external services.

Among the most sensitive leaked information are revenue statistics from Grand Theft Auto Online and Red Dead Online, player behavior data, virtual economy metrics broken down by region and platform (PC, Xbox, PlayStation), and approximately 2.4 million customer support tickets from 2018 to 2026. The good news is that, based on available information, the leak does not appear to contain any personal player data or account credentials. The content is mostly aggregated statistics and internal business telemetry — not information that could identify individual users.

One of the Largest Patch Tuesdays in History

In April 2026, Microsoft released one of the largest security update bundles in its history. A total of 163 CVEs (some sources report up to 167, if browser bugs are counted), eight of them rated critical. This makes it the second-largest Patch Tuesday ever, behind only October 2025. Notable among the patches are an actively exploited SharePoint Server vulnerability (CVE-2026–32201) and, above all, a publicly known exploit for Microsoft Defender dubbed BlueHammer.

BlueHammer (CVE-2026–33825) is a local privilege escalation vulnerability in Microsoft Defender with a CVSS score of 7.8. An attacker with standard user privileges can use it to gain NT AUTHORITY\SYSTEM rights. On April 3, an anonymous researcher going by the handle Chaotic Eclipse published a proof-of-concept exploit on GitHub — reportedly in response to how he felt he had been treated by the Microsoft Security Response Center.

Just two days after Patch Tuesday, on April 16, the same researcher released two more exploits RedSun and UnDefend. RedSun is a second privilege escalation flaw in Defender, this time abusing the way the antivirus handles files marked with cloud tags (OneDrive, Dropbox).

Meanwhile, Huntress Labs has confirmed active exploitation of all three techniques in the wild.

OpenAI Rotates Its macOS Signing Certificates

OpenAI has become an indirect victim of a large-scale supply-chain attack that struck one of the most widely used JavaScript libraries, Axios, back in March.

The company announced that on March 31, its automated GitHub Actions system downloaded and executed a malicious version of the package (specifically version 1.14.1) that had been briefly published to the npm registry. Because that workflow had access to the signing certificates for OpenAI’s macOS applications, the company chose — out of an abundance of caution — to revoke all of those certificates and replace them with new ones.

According to OpenAI’s internal analysis, the certificates were most likely not successfully exfiltrated, but the company took this step as a precautionary measure to protect its users.

The compromised GitHub Actions workflow was responsible for signing all of OpenAI’s desktop applications for macOS — specifically ChatGPT Desktop, Codex, Codex CLI, and the Atlas browser. A signing certificate plays a critical role in confirming to both users and the operating system that software is authentic and comes from a legitimate developer. If attackers had successfully obtained the certificate, they could have used it to sign their own malicious code so that it would appear as an official OpenAI product.

OpenAI identified the root cause as a misconfiguration in its GitHub Actions setup. The Axios package was referenced using what’s known as a floating tag rather than a specific commit hash, and the minimumReleaseAge parameter — which would have prevented the automatic download of a freshly published version — was not set.