A newly established Russian cyber extortion group has hit Expedia—the second-largest online travel agency in the world—exposing nearly one billion traveler records and allegedly holding the company hostage.