European Commission Launches Formal Investigation into Booking.com Over Digital Services Act Compliance

The European Commission has officially launched a formal investigation into the practices of Booking.com, signaling a major regulatory push to address recurring security failures that have exposed travelers to sophisticated phishing scams and fraudulent listings. The probe, which was formally announced on October 21, aims to determine whether the travel giant has adequately fulfilled its obligations under the European Union’s landmark Digital Services Act (DSA). By scrutinizing the platform’s internal safeguards, the Commission seeks to establish whether the company has failed to mitigate systemic risks that threaten consumer safety and data privacy.

The investigation follows a comprehensive preliminary assessment conducted by the Commission, which identified several areas where the platform’s security measures may be insufficient. Under the regulatory framework established by the DSA, which came into force in November 2022, Very Large Online Platforms (VLOPs) are held to stringent standards regarding the protection of their users. Because Booking.com occupies a dominant position in the travel industry, it is subject to these heightened requirements, which necessitate proactive measures to prevent the spread of illegal content, protect user data, and ensure transparency in advertising.

Assessing Data Protection and Phishing Mitigation

A primary focus of the Commission’s investigation concerns the way Booking.com manages and shares sensitive information. The inquiry will delve into the protocols currently in place for sharing reservation details and guest data with accommodation providers. In many reported instances of fraud, attackers have successfully gained access to these internal systems, using the stolen information to contact customers directly, pose as hotel staff, and solicit fraudulent payments.

Regulators are particularly concerned with whether Booking.com has implemented adequate technical and organizational safeguards to prevent this data from being weaponized by cybercriminals. If the Commission finds that the platform’s security architecture—or its oversight of partner access—is fundamentally flawed, the company could be found in breach of its duty to mitigate risks under the DSA. The inquiry will also look closely at the design of the platform’s internal messaging service. As a critical communication channel between guests and hosts, this service has become a favored vector for malicious actors. The Commission intends to determine whether the platform has taken sufficient steps to monitor, detect, and disable the use of these messaging tools for phishing purposes.

Beyond direct communication, the investigation will evaluate the company’s efforts to combat the dissemination of illegal content more broadly. This includes the presence of fraudulent, non-compliant, or "ghost" listings, as well as impersonation tactics that deceive users into believing they are transacting with legitimate businesses. The Commission is also set to examine Booking.com’s advertising practices, ensuring that the company’s methods for displaying and labeling ads align with the transparency mandates of the DSA.

The Threat Landscape: A Persistent Challenge

The decision to open formal proceedings is not without context. In recent years, cybersecurity researchers have documented an alarming surge in sophisticated campaigns specifically targeting Booking.com’s ecosystem. These attacks often leverage a "weakest link" strategy, where hackers compromise the credentials of smaller, less-secure accommodation partners to gain a foothold in the platform’s broader network.

In 2023, security firm Secureworks, which is now part of Sophos, highlighted a disturbing trend involving the deployment of the Vidar infostealer. In these attacks, cybercriminals targeted hotel staff, tricking them into downloading malware that granted the attackers full access to the hotels’ Booking.com administrative accounts. Once inside, the threat actors were able to view real-time reservation data and send highly personalized, convincing phishing emails to guests. These messages often directed victims to fake payment portals, resulting in significant financial losses for travelers who believed they were settling legitimate booking fees.

The sophistication of these campaigns has only continued to evolve. In March 2025, Microsoft researchers identified a widespread "ClickFix" campaign that effectively impersonated the Booking.com brand. The campaign was global in scope, impacting users across North America, Europe, Oceania, and parts of Asia. The attack utilized social engineering to lure victims into executing malicious files under the guise of resolving booking issues, ultimately installing infostealer malware on their devices.

Furthermore, as recently as June 2026, TrendAI Research uncovered a targeted campaign focused on Japanese accommodation providers. The attackers utilized highly contextualized phishing emails that mimicked legitimate guest complaints or requests for review updates. By posing as dissatisfied customers, the hackers pressured hotel staff to open malicious files, creating a cycle of exploitation that further undermined trust in the platform’s communication infrastructure.

Regulatory Implications and Potential Consequences

The European Commission’s move to investigate Booking.com underscores the gravity of these threats. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security, and democracy, emphasized the necessity of the probe in a recent statement regarding the decision. "Europeans should be able to book their holidays without fear of being scammed," Virkkunen noted. "The DSA sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."

The stakes for Booking.com are significant. Should the Commission conclude that the company has failed to comply with its obligations under the DSA, it could face substantial financial penalties. Under the regulation, non-compliance can result in fines of up to 6% of the company’s global annual turnover. Beyond monetary impact, the Commission holds the power to mandate specific corrective measures, forcing the company to overhaul its security infrastructure, data handling protocols, and moderation systems to meet EU standards.

However, the Commission has stressed that the initiation of formal proceedings does not predetermine the final outcome of the investigation. The process is designed to be an objective examination of facts and practices. Throughout the proceedings, the Commission remains empowered to accept formal commitments from Booking.com, allowing the company to propose and implement voluntary remedies to resolve the identified concerns. This approach provides a pathway for the company to address the vulnerabilities without necessarily reaching the stage of punitive action, provided they can satisfy the regulator’s requirements for systemic security.

As the investigation unfolds, it serves as a litmus test for the effectiveness of the Digital Services Act in policing global platforms. The outcome will likely influence how other major online travel agencies and digital intermediaries approach security, transparency, and consumer protection in an increasingly hostile cyber threat environment. For now, the spotlight remains firmly on Booking.com as it navigates this high-stakes regulatory challenge, with the safety of millions of European travelers hanging in the balance. The Commission has signaled that it will continue to monitor the situation closely, ensuring that the platform adheres to the high standards of accountability required by the modern digital economy.