Edelson Lechtzin Probes Class Action Claims After BCD Travel Breach Hits About 700,000 Customers

BCD Travel Services B.V. Has notified affected individuals of a data security incident involving a third-party vulnerability that compromised personal information held in one of its applications, and Edelson Lechtzin LLP is investigating potential class action claims, PR Newswire reported on October 30, 2026. News coverage reports that the breach exposed personal data belonging to about 700,000 customers.

How BCD Travel Handled the Breach

BCD Travel is a global business travel management company that provides travel management, consulting, and related services to corporate clients and their travelers. According to its notice, the company activated its cybersecurity incident response team, took the affected application offline, and launched an in-depth investigation with third-party cybersecurity and forensic experts. BCD Travel implemented recommended security measures and notified law enforcement. The company has said it remains fully operational and that, to date, it has not identified evidence that affected personal information has been misused.

The incident drew public attention after the threat-actor group ShinyHunters claimed responsibility in late May 2026 and threatened to leak more than 700,000 records unless the company met its demands. According to BCD Travel, the personal information involved may include name and date of birth, email address and telephone number, emergency contact details, credit card details, frequent flyer and loyalty program numbers, TSA or Trusted Traveler numbers, passport or ID numbers, and travel itineraries.

BCD Travel is offering affected individuals one year of complimentary credit and identity fraud monitoring through Experian; eligible individuals can enroll using the activation code in their notification letter by the deadline stated in that letter. Edelson Lechtzin LLP is investigating a potential class action on behalf of individuals whose data may have been compromised. Marc Edelson, Esq., of the firm said travelers can "request a free case evaluation." The firm states that a successful case could recover compensation for losses such as lost time, out-of-pocket costs, and loss of privacy, and could press BCD Travel to strengthen its data protection.

Other Breach Claims Edelson Lechtzin Is Pursuing

Edelson Lechtzin is also investigating potential class action claims against STS Aviation Group, which disclosed a data breach on August 5, 2025, where an unauthorized party accessed its systems, exposing personal information including Social Security numbers, financial, and medical data, PR Newswire reported on October 22, 2026. STS Aviation Group reported the incident to state attorneys general and notified at least 319 Massachusetts residents.

Arnold Clark Automobiles admitted in court that its failure to protect customer data led to a December 2022 cyber attack, breaching data protection law, EIN Presswire reported on October 20, 2026. The company accepted liability in principle for a group action involving about 15,000 Scottish motorists, though individual claims and compensation remain undecided.

What Comes Next for Affected Travelers

Affected individuals hold activation codes for the complimentary Experian monitoring and can enroll by the deadline stated in their notification letters. Edelson Lechtzin evaluates claims at no cost for travelers who received a breach notice or believe their information may have been exposed.