BCD Travel — data breach (BCDTravel)

Domain: bcdtravel.com · Accounts affected: 396,313 · Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets · Verified breach — In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets.