The European Commission has officially opened formal proceedings against Booking.com, the world’s leading online travel agency, to determine whether the platform has failed to adequately protect its users from cyber-fraud, phishing attacks, and illicit activity. This regulatory move, announced on October 21, marks a significant escalation in the European Union’s enforcement of the Digital Services Act (DSA), a landmark legislative framework designed to ensure safety, accountability, and transparency across the digital landscape.
The investigation will focus on whether Booking.com has systematically breached the security and transparency provisions mandated by the DSA. As a designated "Very Large Online Platform" (VLOP), Booking.com is subject to the strictest oversight under the regulation, which was brought into force in November 2022 to curb the proliferation of illegal content and systemic risks posed by major digital entities. The Commission’s decision to move to a formal investigation follows a preliminary inquiry that raised substantial concerns regarding the platform’s current operational safeguards.
Assessing Phishing Risks and Data Safeguards
Central to the Commission’s investigation is the question of how Booking.com manages the inherent risks of phishing, which has become a persistent threat to its global customer base. The European Commission is particularly interested in scrutinizing the internal processes governing how reservation and guest data is shared with third-party accommodation providers.
The investigation aims to determine whether the company has exercised sufficient diligence in assessing and mitigating the risks that this data sharing creates. Specifically, regulators are looking for evidence of robust safeguards designed to prevent this sensitive information—which often includes names, contact details, and booking references—from being intercepted or misused by malicious actors to orchestrate sophisticated phishing campaigns or to solicit fraudulent payments from unsuspecting travelers.
Furthermore, the Commission will examine the architecture of Booking.com’s internal messaging service. This platform-integrated communication tool is intended to facilitate dialogue between guests and property owners; however, there are concerns that its design and functioning may be inherently vulnerable to exploitation. The regulators seek to understand whether the firm has implemented sufficient security controls to prevent hackers from leveraging this messaging channel to deceive users or distribute malicious links.
Systemic Risks and Advertising Transparency
Beyond the immediate threat of phishing, the investigation covers broader systemic risks associated with the dissemination of illegal content. The Commission will evaluate whether the platform has implemented adequate measures to identify, report, and mitigate the impact of impersonation fraud—where scammers pose as legitimate property owners—and the listing of non-compliant or non-existent accommodation services.
The scope of the probe also extends to the company’s advertising practices. Under the DSA, platforms are required to adhere to strict transparency obligations regarding how advertisements are targeted, labeled, and presented to users. The Commission aims to ascertain whether Booking.com’s current advertising ecosystem aligns with these requirements, ensuring that users are provided with clear and accurate information about the services they are browsing and booking.
Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, emphasized the urgency of the matter in a statement following the announcement. "Europeans should be able to book their holidays without fear of being scammed," Virkkunen stated. "The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."
If the Commission concludes that Booking.com has failed to comply with the DSA in these critical areas, the consequences could be severe. Under the terms of the regulation, the company could face fines of up to 6% of its global annual turnover. Furthermore, the Commission may compel the firm to implement comprehensive corrective measures to overhaul its security infrastructure and risk-management protocols. The Commission has noted, however, that the opening of these proceedings does not prejudge the final outcome; it remains empowered to accept formal commitments from Booking.com to address and remedy the identified issues voluntarily.
A Persistent Target for Cybercriminals
The formal investigation arrives against a backdrop of years of documented security challenges for the travel industry, with Booking.com frequently serving as a primary target for sophisticated threat actors. Cybersecurity researchers have consistently observed campaigns that exploit the trust inherent in the platform to compromise both travelers and partner accommodations.
In recent years, the nature of these attacks has become increasingly technical. In 2023, researchers at Secureworks (now part of Sophos) detailed how cybercriminals utilized the "Vidar" infostealer malware to compromise the credentials of hotel staff. By gaining unauthorized access to the back-end accounts of partner properties, attackers were able to monitor legitimate reservation threads and send highly convincing, personalized phishing messages to travelers. These messages often contained malicious links or requests for additional payment verification, leading to direct financial theft.
The scale of these operations was further highlighted in March 2025, when Microsoft reported on a widespread "ClickFix" phishing campaign. The attack, which targeted users across North America, Oceania, Europe, and parts of Asia, involved the distribution of emails that expertly mimicked the tone and branding of Booking.com. These emails were designed to lure recipients into clicking links that would ultimately trigger the download of infostealer malware, providing attackers with a foothold in the victim’s device to harvest passwords and session cookies.
Furthermore, in June 2026, researchers at TrendAI Research uncovered a campaign specifically targeting Japanese accommodation partners. In this instance, the threat actors sent emails masquerading as guest complaints or requests for feedback. When hotel staff interacted with the provided files—believing they were addressing a customer service issue—they inadvertently executed malicious code, further compromising the hotel’s digital infrastructure.
These recurring incidents demonstrate that the security of an online travel agency is only as strong as its weakest link. Because the platform acts as an intermediary between individual travelers and thousands of independent property owners, the attack surface is vast and difficult to police. The European Commission’s investigation suggests that the era of self-regulation for such large-scale platforms is ending, as the regulator now seeks to hold Booking.com accountable for the security outcomes of its platform’s ecosystem.
As the proceedings move forward, the travel industry will be watching closely. For Booking.com, the challenge lies in balancing the convenience and accessibility of its platform with the rigorous security demands of the modern digital era. Whether the firm can provide sufficient evidence that its current mitigation strategies are robust enough to satisfy the requirements of the Digital Services Act will be the defining question of this investigation. For now, the company remains under the spotlight, with the Commission maintaining that it is prepared to take whatever action is necessary to protect European consumers in the digital marketplace.
