Lithuanian Traveler Data Leaked on Black-Market Site
A massive breach at two major tour operators exposes 395.5 million records containing sensitive personal and financial info.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust travel agencies to keep your personal and passport information secure?
Personal data belonging to Lithuanian travelers has appeared on a Russian black-market platform following a breach of tour operators Tez Tour and Join Up. The State Data Protection Inspectorate has launched an inquiry into the leak, which encompasses travel records spanning 2012 to 2026.
Why it matters
The incident highlights significant security vulnerabilities in travel sector data management and the downstream risks of large-scale infrastructure breaches. It demonstrates how historical booking archives become high-value targets for threat actors operating across international borders.
The breach reportedly involves 395.5 million records, including 252 million financial transactions and 52 million hotel reservations. These figures dwarf standard annual operational logs, indicating the compromise of a comprehensive historical database.
The players
DataSuckers
A hacking group that claimed responsibility for the breach of systems in Russia and Belarus.
Tez Tour
A tour operator managing international travel bookings whose internal systems were compromised.
State Data Protection Inspectorate
The Lithuanian regulatory body currently conducting an inquiry into the unauthorized exposure of traveler data.
Join Up
A tour operator identified as having its customer information exposed in the records leak.
The details
The hacking group known as DataSuckers allegedly breached systems operated by Tez Tour in Russia and Belarus. By gaining access to these centralized networks, the group reportedly downloaded and subsequently destroyed 395.5 million records containing names, birth dates, passport details, and telephone numbers. This architecture allowed the attackers to consolidate data from diverse touchpoints, including travel itineraries and financial transaction history.
Timeline
2012-2026: Range of travel records exposed in the leak.
Mid-September 2026: DataSuckers claimed responsibility for hacking Tez Tour.
October 21, 2026: Official reporting of the data leak.
The Tech Race
This breach marks a significant escalation in the targeting of travel sector databases, which are often less protected than financial institutions. It follows a pattern of threat actors shifting focus to aggregate historical booking data to facilitate long-term identity exploitation.
Affected travelers may face increased risks of targeted phishing or identity fraud due to the exposure of passport and financial details. Those with bookings via Tez Tour or Join Up should monitor for unauthorized activity on their financial accounts and exercise caution regarding unexpected communications.
The takeaway
The sheer scale of this compromise emphasizes the critical need for robust data minimization policies in the travel industry. Travelers should watch for forthcoming guidance from the State Data Protection Inspectorate regarding potential remediation steps for those impacted by the 14-year data exposure.
Further reading
For broader trends in enterprise defense, explore our Cybersecurity section.
Source note: This article includes information reported by DELFI.
Live Poll
Do you trust travel agencies to keep your personal and passport information secure?
