Orbitz controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile3 entries
2019
Expedia and Orbitz reach Pennsylvania data breach settlement
Settlement
Pennsylvania's attorney general reached a settlement with Expedia and Orbitz following an investigation into a 2018 data breach. The settlement requires the companies to pay $110,000, including an $80,000 civil penalty. The filing alleges that Orbitz misrepresented safeguards in its privacy policy and failed to fully implement Expedia data-security policies.
Company response
Remediation — Expedia and Orbitz
Expedia and Orbitz have agreed to strengthen their security practices going forward by implementing a comprehensive information security program on the Orbitz website, conducting an annual comprehensive risk assessment, and developing a plan and program for designing, implementing, and operating safeguards.
Source excerpt
The office of Pennsylvania attorney general Josh Shapiro has reached a settlement with travel websites Orbitz and Expedia following an investigation into a 2018 data breach.
An investigation into the breach, carried out by Shapiro's office and led by Deputy Attorney General Timothy Murphy, found that a threat actor had used malware to target up to 880,000 payment cards around the world by compromising Orbitz's online travel booking portal.
Under the terms of the settlement, Expedia and Orbitz will pay $110,000, which includes an $80,000 civil penalty.
2009
Webloyalty post-transaction marketing controversy
Orbitz was criticized after reports and a Senate Commerce Committee inquiry examined post-purchase offers that connected customers with third-party membership programs. Some users reported recurring monthly charges after accepting or unintentionally joining these services. The controversy focused on disclosure, consent, payment-card data sharing, and the responsibilities of online merchants that present such offers.
2009
Milgram v. Orbitz ticket-availability dispute
New Jersey alleged that Orbitz violated state consumer-protection law by listing Bruce Springsteen concert tickets that were not actually available. The court granted summary judgment for Orbitz, finding that Section 230 of the Communications Decency Act preempted the asserted state-law claims.