Orbitz, a subsidiary of online travel agency Expedia Inc EXPE.O, said hackers may have accessed personal information from about 880,000 payment cards.
The breach had occurred between Jan. 1, 2016 and Dec. 22, 2017 for its partner platform and between Jan. 1, 2016, and June 22, 2016, for its consumer platform.
Information such as names, phone numbers, email and billing addresses have been accessed.
For U.S. customers, social security numbers were not involved in this incident, the company said.
The company said it has addressed the breach after it was discovered in March this year.
Credit card issuer American Express Co AXP.N said in a statement that the attack did not compromise its platforms.
Expedia’s shares fell as much as 1.9 percent to $108.99.
"id": "EXP16239622",
"linkid": "expedia",
"type": "Breach",
"date": "03/2018",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"