CHICAGO, March 20, 2018 – Orbitz announced today that it has identified and remediated a data security incident affecting a legacy travel booking platform. The company made the following statement:

While conducting an investigation of a legacy Orbitz platform, we determined on March 1, 2018 that there was evidence suggesting that, between October 1, 2017 and December 22, 2017, an attacker may have accessed personal information stored on this consumer and business partner platform. We took immediate steps to investigate the incident and enhance security and monitoring of the affected platform. As part of our investigation and remediation work, we brought in a leading third party forensic investigation firm and other cybersecurity experts, began working with law enforcement, and took swift action to eliminate and prevent unauthorized access to the platform.

Customers and partners are being notified about what personal information may have been accessed in the incident. Following is a summary:

• The current Orbitz.com website was not in any way involved in this incident.
• For the Orbitz consumer platform data, our investigation determined that the attacker may have accessed personal information that was submitted for certain purchases made between January 1, 2016 and June 22, 2016.
• For the Orbitz partner platform data, our investigation determined that the attacker may have accessed personal information that was submitted for certain purchases made between January 1, 2016 and December 22, 2017.
• The total number of payment cards impacted by this incident is approximately 880,000.
• Information that was likely accessed may include full name, payment card information, date of birth, phone number, email address, physical and/or billing address, and gender.
• To date, we do not have direct evidence that this personal information was actually taken from the platform.
• Our investigation to date has not found any evidence of unauthorized access to other types of personal information, including passport and travel itinerary information.
• For U.S. customers, Social Security numbers were not involved in this incident, as they are not collected nor held on the platform.

Ensuring the safety and security of the personal data of our customers and our partners’ customers is very important to us. We deeply regret the incident, and we are committed to doing everything we can to maintain the trust of our customers and partners.

We are working quickly to notify impacted customers and partners. We are offering affected individuals one year of complimentary credit monitoring and identity protection service in countries where available. Additionally, we are providing partners with complimentary customer notice support for partners to inform their customers, if necessary. Anyone who is notified is encouraged to carefully review and monitor their payment card account statements and contact their financial institution or call the number on the back of their card if they suspect that their payment card may have been misused.

Orbitz customers with questions may call 1-855-828-3959 (toll-free U.S.) or 1-512-201-2214 (International), Monday through Saturday, 8:00 am to 8:00 pm CDT or visit orbitz.allclearid.com for more information.

About Orbitz.com

Orbitz.com is a leading travel website where millions of consumers search for and book a broad range of hotels, flights, car rentals, cruises, vacation packages and destination activities. Orbitz.com offers the groundbreaking Orbitz Rewards loyalty program—the only program where customers can earn rewards immediately on flights, hotels and packages, and redeem instantly on tens of thousands of hotels worldwide. Orbitz.com is the #1 way to book travel on mobile devices, be it using our apps (get them at orbitz.com/mobile) or our smartphone-optimized website (m.orbitz.com), both of which are tailored for smartphones and tablets. Follow Orbitz on Facebook, Twitter, Instagram and through the Orbitz Travel Blog.

©2018 Orbitz, LLC. All rights reserved. Orbitz, Orbitz.com, and the Orbitz logo are either registered trademarks or trademarks of Orbitz, LLC in the U.S. and/or other countries. Other logos or product and company names mentioned herein may be the property of their respective owners. CST# 2063530-50;