Hotels.com & Expedia Provider Exposes Millions of Guests' Data

Prestige Software, a provider of hotel reservation software, has reportedly exposed sensitive data belonging to millions of travelers in a misconfigured Amazon Web Services S3 bucket. The incident compromised at least 10 million log files dating back to 2013, Website Planet reports.

The Spain-based company offers a channel management platform called Cloud Hospitality that online booking websites such as Expedia, Hotels.com, and Booking.com use to connect with hotel reservations. A channel manager ensures hotel room availability is updated across sites so, for example, if someone books a room on Expedia, it's no longer available on Booking[.]com.

Customer data exposed includes personally identifiable information such as full names, email addresses, national ID numbers, and guest phone numbers, as well as financial data such as credit card numbers, cardholder name, CVV, and expiration date. The bucket also contained hotel reservation data such as reservation number, dates, price per night, guest requests, and total cost, in addition to other info. 

The S3 bucket was still active and in use at the time researchers discovered it, with new records uploaded within a few hours of investigation. It held more than 180,000 records from August 2020 alone, many of which were connected to hotel reservations made on several websites.

It's difficult to say how many people are affected by this incident because many exposed logs held data for multiple people on a single reservation. Researchers could not confirm whether the data was accessed prior to their discovery of the open bucket; however, they note there would be "enormous implications" for individuals' privacy, security, and financials if this happened.

Given the amount and sensitivity of data exposed, Website Planet contacted AWS directly and the bucket was secured. Prestige Software confirmed it owned the data shortly after. 

Read more details here.