Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A report dated October 5, 2026, says a threat actor using the alias “Marx” claimed to have millions of records allegedly linked to Airbnb, Uber, PayPal, Booking.com, and Google. That is a reported claim—not confirmation that the companies were breached or that the records are authentic. The evidence available does not establish the dataset’s contents, per-company counts, or whether any named company confirmed the listing.
What is known about the alleged records for sale?
Cybernews’ October 5, 2026 report listing attributes the claim to an actor using the name “Marx” and names Airbnb, Uber, PayPal, Booking.com, and Google. The title highlights Airbnb, Uber, and Google, but the listing also names the other two companies.
The available information establishes that the claim was reported. It does not independently establish that the records exist, are genuine, or came from the companies named. It also does not say what fields the alleged data contains, how many records are associated with each company, or whether the seller provided files that an independent researcher inspected. The meaning of the actor’s claimed “access”—a sample, a dataset, or ongoing access to systems—is unresolved.
Have Airbnb, Uber, or Google confirmed a breach?
The evidence available for this report does not show confirmation from Airbnb, Uber, or Google, nor does it establish that any of the named companies notified users about this listing. That absence of confirmation in the available material is not proof that no company has responded elsewhere; it means the listing should not be presented as a verified breach.
#1 Best Overall
Airbnb’s law-enforcement transparency reports page describes how it handles government requests under its policies and guidelines. Uber’s data disclosure requests help page says it responds to requests within applicable legal frameworks. These pages concern lawful requests for information; they do not corroborate the alleged sale.
Is this connected to Uber’s 2016 breach?
No connection is established. The U.S. Department of Justice documented a separate Uber incident from 2016: approximately 57 million user records and 600,000 driver’s-license numbers were involved, according to the DOJ’s 2022 announcement. That historical breach is distinct from the 2026 claim and does not verify it.
For context on that earlier incident, see the Department of Justice announcement.
What should you do if you use one of these services?
Because the listing does not establish who is affected or what information may be involved, there is no basis in the available evidence to say that a particular user’s account or data was exposed. Avoid treating the claim alone as proof of personal exposure. If a named company contacts you, verify the notice through its official app or website rather than following links in an unsolicited message.
Until a company or credible independent investigation confirms a specific exposure, routine account-safety practices are sensible but cannot determine whether the alleged dataset is authentic or includes you. Watch for official notices and use each service’s account-security settings if you have a separate reason to review your account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
