“Booking.com requested help from the Dutch intelligence service, AIVD, in its investigation into the extensive data breach, but did not notify the affected customers or the Dutch Data Protection Authority (AP).”
In 2016 a hacker tied to US intelligence pulled thousands of hotel reservations in Saudi Arabia, Qatar and the UAE out of Booking.com. The company traced him in two months and called in Dutch spies. It told none of the customers whose names and travel plans were taken. A law firm said silence was legal. The people on those reservations still don’t know who has their itinerary.