The International Journal of Security has revealed that some of the world's biggest hotel chains have had their personal information compromised following a threat actor's attack on a program provider that serves the industry.
As part of a data breach on Otelier's Amazon S3 cloud storage system, threat actors were able to steal millions of guests' personal information and reservations for well-known hotel brands like Marriott, Hilton, and Hyatt after breaching the cloud storage.
According to the threat actors, almost eight terabytes of data were stolen from Otelier's Amazon AWS buckets during the period July 2024 through October 2024, with continued access continuing to this date until October.
Hotelier, one of the world's leading cloud-based hotel management platforms, has reportedly confirmed a data breach affecting its Amazon S3 storage that exposed sensitive information from prominent hotel brands such as Marriott, Hilton, and Hyatt through the exposure of sensitive data from its Amazon S3 storage, according to reports.
There were reports of unauthorized access to 7.8 terabytes of data from threat actors during this period. These threats were reported as starting in July 2024 and continuing until October 2024.
There has been no report of any incident at Otelier as of now, but they have reportedly suspended their operations and have entrusted an expert team to investigate the incident.
A freelance security expert, Stacey Magpie, speculates that the stolen data may contain sensitive data like email addresses, contact information, the purpose of the guest's visit, and the length of the stay, all of which could be utilized for phishing schemes and identity theft attacks.
Telier, also formerly known as "MyDigitalOffice," has not yet made an official statement regarding the breach, but it is thought that a threat group is responsible for the attack.
By using malware, the group may have been able to gain access to an employee's Amazon Web Services credentials and then transfer the stolen data to the company's servers. A spokesperson from the company has confirmed that no payment, employee, or operational data was compromised during this incident.
An Otelier employee was recently reported to have had his Atlassian login credentials stolen by malicious actors using an information stealer.
A user with this access is then able to scrape tickets and other data, which allows the attackers to get the credentials for S3 buckets, which is where the attackers obtained the credentials. As a result of this exfiltration, the hackers managed to get 7.8TB of data from these buckets, including millions of documents belonging to Marriott. The information contained in these buckets included hotel reports, shift audits, and accounting data, among other things.
Among the data samples offered by Marriott were reservations, transactions, employee emails, and other internal data about hotel guests. There were instances where the attackers gained the names, addresses, phone numbers, and email addresses of hotel guests. The company confirmed that through Otelier’s platform, the breach indirectly affected its systems.
A forensic analysis of the incident has been conducted by Otelier as a result of the suspension of the company's automated services with Otelier, which said it had hired cybersecurity experts to do so.
Additionally, according to Otelier, affected accounts were disabled, unauthorized access had been terminated, and enhanced security protocols had been implemented to prevent future breaches from occurring. According to Otelier, affected customers have been notified of the breach.
It is said that the hackers accessed Otelier's systems by compromising the login credentials of an employee who used malware to steal information. By using these credentials, they were able to access the Atlassian server on which the company's Atlassian applications were hosted.
These credentials allowed them to gather additional information from the company, including credentials for Amazon S3 buckets. Based on their claims, they were able to extract data, including information regarding major hotel chains, using this access.
In their initial attempt to get Marriott's data, the attackers mistakenly believed that the data belonged to Marriott itself. To avoid leaking data, they left ransom notes that demanded cryptocurrency payments. Otelier rotated their credentials in September, which eliminated the attacker's access.
There are many types of data in the small samples, including hotel reservations and transactions, employee emails, and other internal files.
In addition to information about hotel guests, the stolen data also includes information and email addresses related to Hyatt, Hilton, and Wyndham, as well as information regarding the properties owned by these companies.
As Troy Hunt revealed during an interview for BleepingComputer, he has been given access to a huge dataset of data, which contains 39 million rows of reservations and 212 million rows of users in total. As a result of the substantial amount of data, Hunt tells us that he found 1.3 million unique email addresses, many of which appeared several times in the data.
As a result of the recently discovered vulnerability, the exposed data is now being added to Have I Been Pwned, making it possible for anyone to examine if their email address appears to be a part of the exposed data. The breach affected a total of 437,000 unique email addresses which originated during reservations made with Booking.com and Expedia.com, thus resulting in a total of 1,036,000 unique email addresses being affected.
A robust data protection strategy should be implemented by businesses in the hospitality sector to minimize risks, including the implementation of effective data continuity plans, the application of regular software updates, the education of staff regarding cybersecurity risks, the automation of network traffic monitoring for suspicious activity, the installation of firewalls to prevent threats, and the encryption of sensitive information.
