Threat Intelligence

7/6/2017
02:30 PM
50%
50%

Sabre Breach Investigation Concludes with Impact Limited

The travel company finds that attackers gained limited access to a subset of its bookings in its reservation system.

Travel company Sabre concluded its investigation into the security breach of its reservation system that serves more than 32,000 properties and found the attackers' access was limited to a subset of its bookings.

Sabre, which disclosed the breach in early May after attackers infiltrated its Sabre Hospitality Solutions (SHS) reservation system, found payment card information was accessed for a limited subset of hotel bookings.

The travel company also discovered that a large percentage of the hotel bookings were made without the use of revealing the security code on the back of the payment card, and other bookings were processed via virtual card numbers.

Sabre noted that attackers did not access personal information, such as Social Security numbers, nor passport or driver's license numbers. And while its investigation did not reveal that attackers removed information from Sabre's reservation system, it notes there is a possibility that it may have occurred.

Read more about Sabre's investigation here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Ways Greed Has a Negative Effect on Cybersecurity
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  6/11/2018
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10997
PUBLISHED: 2018-06-17
Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword.
CVE-2018-11218
PUBLISHED: 2018-06-17
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
CVE-2018-11219
PUBLISHED: 2018-06-17
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVE-2018-10377
PUBLISHED: 2018-06-17
PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
CVE-2018-10969
PUBLISHED: 2018-06-17
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.