Loyalty program details leaked: what it means and what to do
Risk level: medium. Can you change it: no. Found in 4 breaches in this directory.
What this data is
Your membership number, points balance, tier, purchase history and linked details from a supermarket, airline, hotel, fuel or retail rewards scheme.
The risk on its own
Loyalty points are money in all but name, and many programs protect them with little more than a membership number and a simple password. In some programs a leaked number alone is enough to redeem points at a checkout. Purchase histories also reveal habits, locations and routines.
The risk combined with other data
With your email and a reused password, criminals log in, convert points into gift cards or vouchers and are gone before you notice. Your name and tier also make fake rewards emails convincing, such as warnings that points expire unless you log in through a link. Many members rarely check their balance, so theft is slow to surface.
How criminals use it
An attacker logs in to your rewards account and converts your points into gift cards.
A points about to expire email, branded as your program, leads to a fake login page.
Someone quotes your membership number at a checkout and spends your balance.
Frequent flyer points are transferred to another member or used for flights in someone else's name.
What to do now
Log in to each loyalty program, change the password to a unique one and check the points history for redemptions you did not make.
Set a redemption PIN or turn on two-factor authentication where the program offers it.
Ask the program to issue a new membership number or card if yours leaked.
Keep your contact details current so you receive redemption alerts, and check your balance regularly.
Log in only through the official app or a typed web address, never through links in emails about expiring points.
Frequently asked questions
Will I get stolen points back?
Many programs restore points after investigating fraud, but it is at their discretion. Report it quickly and keep screenshots of your points history.
Is a leaked membership number a problem?
It can be, because some programs accept the number alone at a checkout. Ask for a replacement card and set a PIN if one is available.
Why do criminals target loyalty points?
Points are easy to turn into gift cards or goods, rarely watched by members and usually less protected than bank accounts.
Breaches that exposed this data
Carnival: 2026-04-18, 7.5M accounts, Dates of birth, Email addresses, Genders, Geographic locations, Loyalty program details, Names
Vietnam Airlines: 2025-06-20, 7.3M accounts, Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers
MalindoAir: 2019-03-01, 4.3M accounts, Dates of birth, Email addresses, Genders, Loyalty program details, Names, Nationalities
Utair: 2019-03-21, 401K accounts, Dates of birth, Email addresses, Genders, Loyalty program details, Names, Passport numbers
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.