Did the Travala data breach expose my passport and home address?

On 18 June 2026, at about 1:30 a.m. in Singapore, an outsider used a Travala developer’s stolen login to enter the company’s live systems and copy customer databases. The login had been taken by malware from the developer’s personal computer. Travala Pte. Ltd., a Singapore travel company, confirmed this in a 29 June 2026 letter to the New Hampshire Attorney General and in a company blog post on 27 August 2026.

Travala says it shut that access down, rebuilt servers, changed credentials, and notified regulators, including Singapore’s PDPC. It does not hold passport photos, seed phrases or private keys, and it says customer funds and wallet access were not taken. It has not published a worldwide total. A New Hampshire filing lists one resident; a Massachusetts notice, as described by a law firm, lists four. Travala says every affected user was sent an email naming the categories that applied to their account.

The part that actually changes things for you

Most accounts of this incident, including Travala’s August update, lead with what was not stolen: your booking money, your crypto, your seed phrase, your private keys. That is true. It is also the wrong first question if you booked travel, not if you are trying to value the company.

What was copied is a customer file. For people in that file it can include legal name, home address, email, phone number, nationality, date of birth, passport number and expiry date, the username on the account, a scrambled copy of the password, the identifiers that connect the account to Facebook, Google or Apple, two-factor login data, and, where someone used one, a record of a crypto wallet. That fuller list is in Travala’s June letter to regulators. The August blog is milder. It talks about “certain text-based customer information” such as emails, names and phone numbers, and says active two-factor methods were unaffected. The June letter is the more specific document.

Put plainly, this is not a story about a drained account. It is a story about a named person, at a known home address, with a passport number, written down as a Travala customer — and in some cases as someone with a crypto wallet next to that name. That file cannot spend anyone’s coins. It can be used to impersonate someone, to send mail or messages that already know where they live and that they book travel this way, or to tie a real identity to crypto activity. “Funds are safe” is accurate. It is not the same as “you are not exposed.”

What to actually expect

• Travala says it already emailed every affected customer with the categories that applied to that account. Look for that message from late June 2026 onward, including spam and older inboxes you used on the site. Not receiving one is what the company says should happen if you were not in the file; it is not a guarantee, and nobody can look you up in the stolen copy for you.
• Expect follow-up mail and texts that pretend to be Travala, a lawyer, or a regulator, offering a “breach portal,” a refund, or a chance to “confirm your passport.” Travala has already told people to watch for phishing. A genuine notice will not ask for a seed phrase, a passport photo, or a wallet connection in order to “verify” you.
• If a passport number was stored on the account, the live risk is someone using that number with a name and date of birth — for credit, a phone account, or something travel-related. That does not show up as a crypto transaction. It shows up later, as post you did not request or as an application you never made.
• If a wallet was linked to Travala, assume that link — a wallet record sitting beside a real name and address — was in the copied file. That does not hand anyone the keys. It does hand them a mapping.

What you can and cannot fix

If your details were in the copied databases, they cannot be pulled back. A name, home address, email address, phone number, date of birth, nationality, and passport number, once copied, stay copied. Nobody can delete the attacker’s file, and nobody can promise to remove it. Scrambled passwords and two-factor data from June 2026 belong in that same bucket: treat them as gone even though Travala later said live two-factor methods still work. Wallet records, if they were on the account, are out too. The keys are not. The association is.

• Treat any unexpected Travala, “class action,” or “passport verification” message as hostile until you have opened the company site yourself by typing the address. Do not use links in the message.
• On Travala, change the password and review two-factor settings and any connected Google, Apple or Facebook login. The June regulator letter listed scrambled passwords, those linked logins, and two-factor data among what may have been copied.
• If a passport number was on the account, you generally cannot change that number on demand. Watch credit files and any airline or government account that keys off that document. Report misuse. A new Travala password does not fix a leaked passport number.
• Shrink the extra data that makes the leaked file useful. People-search and data-broker listings often already show relatives, old addresses, phone numbers and an employer. A Travala record of a named person at a home address, with a passport number, becomes much more dangerous when it can be joined to that public pile. Those listings, unlike the stolen database, can actually be taken down. Removing them does not undo the breach. It does stop a stranger from adding family members and a work history to a file they already have.