Millions of records belonging to users of Booking.com, Agoda, Expedia Group, Hotels.com may have lost their sensitive data.

A number of popular online travel agencies such as in total exposed 24.4 GB worth of data, featuring credit card details, names, ID numbers and reservation details. It is estimated that over 10 million people are affected.

The culprit of a data loss is a Spanish based reservation platform Prestige Software, which sells a software “Cloud Hospitality” for hotels to integrate their reservation systems with online booking websites.

It is reported that starting from 2013 Prestige Software was storing incredibly sensitive data about hotel guests and travel agents with no decent protection on a misconfigured Amazon Web Services (AWS) S3 bucket.

According to the security team at Website Planet, who investigated the breach, they contacted AWS immediately and the S3 bucket was secured the following day.