The Dutch online travel agency has confirmed to customers that they recently noticed "suspicious activity", and that criminals have gained access to names, email addresses, phone numbers and details about past and present bookings.
But they haven't said how many customers have been affected, and where they are based.
However, Booking.com insisted financial information has not been obtained from their systems.
In an email to customers, which has been seen by the BBC, Booking.com told guests: "We recently noticed suspicious activity affected a number of reservations and we immediately took action to contain the issue."
Booking.com has now reminded customers that the company won't ever ask for "card details by email, over the phone, WhatsApp or text".
They told the BBC: "Booking.com will never ask guests to share credit card details by email, over the phone, WhatsApp or text, or ask guests to make a bank transfer that is different from the payment policy details in their booking confirmation."
Following the hack, some believe "reservation hijack scams" are on the rise and becoming "more dangerous".
Luis Corrons, security evangelist at Norton, said: "Reservation hijack scams have been around for some time, but this new data makes them much more dangerous because it gives criminals precision as they can reference the real property, the real travel dates, the right contact details to make the scam feel like routine customer service."
Earlier this month, Luis urged travellers to "trust your booking, not the message", and to independently very any queries from travel companies.
He told the Daily Mail: "For years, the best advice on travel scams was simple, watch for bad grammar, generic messages, and suspicious links. That advice still matters, but it's no longer enough.
"What we're seeing with the reservation hijack scam is a clear evolution in how attackers operate and there two main routes they are adopting. The first is impersonation.
"The second, more sophisticated route is account takeover, where attackers gain access to real hotel systems and contact guests through legitimate booking platforms using genuine reservation details. At that point, the scam is truly embedded in a real customer journey which makes it tricky to identity."
