OrganisationRU

Anywayanyday

Russian online travel agency whose bookings were halted by an October 2026 cyberattack.

Anywayanyday is a Russian online travel agency selling air tickets, rail tickets and hotel bookings to consumers, agents and business travellers.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

When will Anywayanyday restore bookings, and was any customer data exposed?

Timeline for Anywayanyday

#15 17 Oct

Halted new bookings after an attack

Cybersecurity: Threats and Defences: FirstVDS loses client data via VMmanager

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Anywayanyday is a Russian online travel agency selling air tickets, rail tickets and hotel bookings. It serves consumers, agents and business travellers through a digital Booking service. Customers depend on that service to search for travel, create reservations and retrieve Booking information without visiting a physical agency.

Common Questions

What happened to Anywayanyday in October 2026?

Anywayanyday temporarily suspended new air, rail and hotel bookings after a cyberattack on its IT infrastructure on 14 October.Source: The Record

Are existing Anywayanyday bookings still valid?

The company said previously confirmed reservations remained valid while it worked to restore its systems.Source: Anywayanyday via The Record

Was customer data stolen from Anywayanyday?

Anywayanyday said it had found no evidence that customer personal data was compromised. It did not identify the attacker or explain how the breach occurred.Source: Anywayanyday via The Record

Source Material

Russian travel booking platform suspends reservations after cyberattack Anywayanyday agency booking service

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.