INFORMATION ABOUT ORBITZ DATA SECURITY INCIDENT
NOTICE OF DATA BREACH
Orbitz has established this website as a resource for customers whose personal information may have been affected by a recent data security incident. Ensuring the safety and security of the personal data of customers and partners’ customers is very important to Orbitz, and Orbitz regrets any inconvenience caused by this incident. As soon as it was determined that there was likely unauthorized access to certain personal information, Orbitz took swift action to address the issue and protect customers. Importantly, the current Orbitz.com website was not in any way involved in this incident.
While conducting an investigation of a legacy Orbitz travel booking platform (the “platform”), Orbitz determined on March 1, 2018 that there was evidence suggesting that, between October 1, 2017 and December 22, 2017, an attacker may have accessed certain personal information, stored on this consumer and business partner platform, that was submitted for certain purchases made between January 1, 2016 and June 22, 2016 (for Orbitz platform customers) and between January 1, 2016 and December 22, 2017 (for certain partners’ customers). Orbitz immediately began investigating the incident and made every effort to remediate the issue, including taking swift action to eliminate and prevent unauthorized access to the platform.
What Information Was Involved?
On March 1, 2018, Orbitz determined that the personal information that was likely accessed may have included full name, payment card information, date of birth, phone number, email address, physical and/or billing address, and gender.
What Information Was Not Involved?
Orbitz’ investigation to date has not found any evidence of unauthorized access to other types of personal information, including passport and travel itinerary information. Additionally, Orbitz can assure U.S. customers that Social Security numbers were not involved in this incident, as these are not collected nor held on the platform.
What We Are Doing
Orbitz took immediate steps to investigate the incident and enhance security and monitoring of the affected platform. As part of the Company’s investigation and remediation work, Orbitz brought in a leading third party forensic investigation firm and other cybersecurity experts, began working with law enforcement, and took measures to effectively prevent any unauthorized access and enhance security. Upon determining that the attack may have resulted in access to certain personal information, Orbitz also started working immediately to notify potentially impacted customers and business partners.
Orbitz is offering affected customers one year of complimentary credit monitoring and identity protection service in countries where available.
- Affected customers residing in the U.S. may sign up for this service by submitting their information on https://orbitz.allclearid.com or contacting 1-855-828-3959 toll-free.
- Affected customers residing outside of the U.S. should call 1-512-201-2214 to learn more about resources being offered in international jurisdictions.
What Affected Customers Can Do
Affected customers should remain vigilant in regularly reviewing and monitoring all of their account statements and credit history to guard against any unauthorized transactions or activity. If customers discover any suspicious or unusual activity on their accounts, they should contact their financial institution or call the number on the back of their payment card.
For more information please call 1-855-828-3959 (Toll-free U.S.) or 1-512-201-2214 (International).
Additional Information for Customers Residing in the U.S.
To protect against possible fraud, identity theft, or financial loss, we encourage you to remain vigilant, review your account statements, and monitor your credit reports. Provided below are the names and contact information for the three major U.S. credit reporting agencies and additional information about steps you can take to obtain a free credit report and to place a fraud alert, credit freeze, or credit lock on your credit report. If you believe you are a victim of fraud or identity theft you should consider contacting your local law enforcement agency, your State’s attorney general, or the Federal Trade Commission.
INFORMATION ON OBTAINING A FREE CREDIT REPORT
U.S. residents are entitled under U.S. law to one free credit report annually from each of the three major credit reporting agencies. To order your free credit reports, visit www.annualcreditreport.com or call toll-free (877) 322-8228.
INFORMATION ON IMPLEMENTING A FRAUD ALERT, CREDIT FREEZE, OR CREDIT LOCK
To place a fraud alert, credit freeze, or credit lock on your credit report, you must contact the three credit reporting agencies below:
|Consumer Fraud Division||Credit Fraud Center||TransUnion LLC|
|P.O. Box 740256||P.O. Box 9554||P.O. Box 2000|
|Atlanta, GA 30374||Allen, TX 75013||Chester, PA 19022-2000|
Fraud Alert: Consider contacting the three major credit reporting agencies at the addresses above to place a fraud alert on your credit report. A fraud alert indicates to anyone requesting your credit file that you suspect you are a possible victim of fraud. A fraud alert does not affect your ability to get a loan or credit. Instead, it alerts a business that your personal information might have been compromised and requires that business to verify your identity before issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it might protect against someone else obtaining credit in your name.
To place a fraud alert, contact any of the three major credit reporting agencies listed above and request that a fraud alert be put on your file. The agency that you contacted must notify the other two agencies. A fraud alert is free and lasts 90 days, but can be renewed.
Credit Freeze: A credit freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report until the freeze is lifted. When a credit freeze is in place, no one—including you—can open a new account. As a result, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing, or other services.
To place a credit freeze, contact all three credit reporting agencies listed above and provide the personal information required by each agency to place a freeze, which may include:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security Number;
- Date of birth;
- If you have moved in the past five (5) years, the addresses where you have lived over the prior five years;
- Proof of current address, such as a current utility bill or telephone bill;
- A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.);
- If you are a victim of identity theft, a copy of either a police report, investigative report, or complaint to a law enforcement agency concerning identity theft; and
- If you are not a victim of identity theft, payment by check, money order, or credit card (Visa, MasterCard, American Express, or Discover only). Do not send cash through the mail.
When you place a credit freeze, you will be provided a PIN to lift temporarily or remove the credit freeze. A credit freeze generally lasts until you lift or remove it, although in some jurisdictions it will expire after seven years. The cost to place a credit freeze is typically between $5.00 and $10.00 each time you place a freeze, but may vary by jurisdiction. Certain jurisdictions may also permit a credit reporting agency to charge you similar fees to lift or remove the freeze. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place, lift, or remove a credit freeze.
Credit Lock: Like a credit freeze, a credit lock restricts access to your credit report and prevents anyone from opening an account until unlocked. Unlike credit freezes, your credit can typically be unlocked online without delay. To lock your credit, contact all three credit reporting agencies listed above and complete a credit lock agreement. The cost of a credit lock varies by agency, which typically charges monthly fees.
You may also contact the U.S. Federal Trade Commission (“FTC”) for further information on fraud alerts, credit freezes, credit locks, and how to protect yourself from identity theft. The FTC can be contacted at 400 7th St. SW, Washington, DC 20024; telephone 1-877-382-4357; or www.consumer.gov/idtheft.
Your state Attorney General may also have advice on preventing identity theft, and you should report instances of known or suspected identity theft to law enforcement, your State Attorney General, or the FTC.
Maryland Residents: The Attorney General can be contacted at Office of Attorney General, 200 St. Paul Place, Baltimore, MD 21202; (888) 743-0023; or http://www.oag.state.md.us.
Massachusetts Residents: Under Massachusetts law, you have the right to obtain any police report filed in connection to the incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.
North Carolina Residents: The Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; (919) 716-6400; or http://www.ncdoj.gov.
New Mexico Residents: You have rights under the federal Fair Credit Reporting Act (FCRA), which governs the collection and use of information pertaining to you by consumer reporting agencies. For more information about your rights under the FCRA, please visit https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov.
Rhode Island Residents: The Attorney General can be contacted at (401) 274-4400 or http://www.riag.ri.gov/. You may also file a police report by contacting local or state law enforcement agencies.