No, you cannot join a BCD Travel class action now because no class action has been certified and no settlement exists. If you received BCD's October 2026 breach letter, you can ask a law firm to review a possible privacy claim. BCD Travel USA LLC is a corporate travel management company. The issue involves an unauthorized access to an enterprise user account that held traveler names and passport-related information.
Official resources:
- Check eligibility on Prnewswire’s official study page — Use this page to check the study’s participation requirements.
- Explore the official data from Databreachclassaction — Use this primary source to review the underlying data.
Table of Contents
- What happened in the breach?
- What personal information was involved?
- Who may seek a legal review?
- What should recipients do next?
What happened in the breach?
Dapeer Law reports that BCD told the New Hampshire Attorney General about suspicious activity detected around May 26, 2026, with file copying between May 22-26, 2026, as described in Dapeer Law's breach investigation update. The actor accessed an enterprise user account and copied files from it. BCD then mailed individual notification letters starting Oct.
26, 2026, and submitted its New Hampshire notice Oct. 27, 2026. ClassActionU and Kopelowitz Ostrow report that an Oct. 23 postal check had identified one notice recipient in that state.
What personal information was involved?
Console and Associates, reporting through DataBreachClassAction.io, says the state filing identified names plus passport information or passport and government ID numbers in the affected account, as listed in Console and Associates' case investigation. That combination matters because passport numbers are harder to replace than payment card numbers.
Edelson Lechtzin reported that the group ShinyHunters claimed responsibility in late May 2026 and threatened to leak more than 700,000 records. A passport exposed in that type of incident can be misused for identity fraud and targeted phishing.
Who may seek a legal review?
Console and Associates says people who received BCD's October 2026 letter, or did business with BCD with data in the affected account, are the group firms say may seek review. Keep the envelope and letter together because the letter connects you to the incident group.
No firm enrolls you automatically by receiving a letter. Edelson Lechtzin states through PR Newswire that its work is an investigation of possible claims, with confidential review, not a certified case, as explained in Edelson Lechtzin's investigation notice.
What should recipients do next?
Dapeer Law points recipients to several practical steps after a breach notice. Those steps focus on preserving proof and watching for misuse tied to the exposed identifiers.
- Keep the BCD notification letter and envelope in a safe place
- Monitor bank, credit, and travel accounts for unfamiliar activity
- Consider a fraud alert or credit freeze
- Watch for emails or calls that use breach details to seem legitimate
- Ask about a free confidential case review if you received the letter