And their insecure platform. You occasionally get completely legit-looking phishing emails from the hotel you wanna stay in, because the hotel‘s account was compromised and attackers now send phishing emails through their side of booking.com.

Booking blames this on the hotels (probably true to some extend), but the problem is quite widespread so that Booking probably bears some responsibility, too.