Hotels.com & Expedia Provider Exposes Millions of Guests' DataHotels.com & Expedia Provider Exposes Millions of Guests' Data
Hotel reservation platform Prestige Software compromised personal data belonging to millions of travelers through a misconfigured AWS S3 bucket.
November 10, 2020
Prestige Software, a provider of hotel reservation software, has reportedly exposed sensitive data belonging to millions of travelers in a misconfigured Amazon Web Services S3 bucket. The incident compromised at least 10 million log files dating back to 2013, Website Planet reports.
The Spain-based company offers a channel management platform called Cloud Hospitality that online booking websites such as Expedia, Hotels.com, and Booking.com use to connect with hotel reservations. A channel manager ensures hotel room availability is updated across sites so, for example, if someone books a room on Expedia, it's no longer available on Booking[.]com.
Customer data exposed includes personally identifiable information such as full names, email addresses, national ID numbers, and guest phone numbers, as well as financial data such as credit card numbers, cardholder name, CVV, and expiration date. The bucket also contained hotel reservation data such as reservation number, dates, price per night, guest requests, and total cost, in addition to other info.
The S3 bucket was still active and in use at the time researchers discovered it, with new records uploaded within a few hours of investigation. It held more than 180,000 records from August 2020 alone, many of which were connected to hotel reservations made on several websites.
It's difficult to say how many people are affected by this incident because many exposed logs held data for multiple people on a single reservation. Researchers could not confirm whether the data was accessed prior to their discovery of the open bucket; however, they note there would be "enormous implications" for individuals' privacy, security, and financials if this happened.
Given the amount and sensitivity of data exposed, Website Planet contacted AWS directly and the bucket was secured. Prestige Software confirmed it owned the data shortly after.
Read more details here.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report
2021 Gartner Market Guide for Managed Detection and Response Report
Supply Chain Cyber Risk Management Whitepaper