Breach Brief – Booking.com, Expedia.com

Now most people have never heard of Prestige software. But that is not the problem here. The problem is that travel sites like Expedia.com and Booking.com is using the software and their customer data was compromised. But its not their fault.

To explain what happened lets first understand the situation. According to Website Planet Spanish company Cloud Hospitality channel management software leaked the data. The software is used by hotels to automate the status of their vacancies on various booking websites. So since the platform is used to connect with the reservation websites, some of the data came from Expedia and Booking.com but the data leak is not their fault.

The data was stored on a mis-configured Amazon Web Services (AWS) S3 bucket belonging to Prestige Software, a Spain-based company that sells hotel reservation management software. So the bottom line is that one of the nerds somewhere screwed up and left the data wide open.

Now what was lost?

This is where it gets nasty. Over 10 million log files! Yes, ten million! And the information goes all the way back to 2013. The data compromised included a range of personally Identifiable Information (PII), such as guest’s full names, national ID numbers, email addresses, phone numbers, as well as details such as the reservation number, dates, number of guests and their names and the price paid. It gets worse. The S3 bucket also contained valuable financial data such as credit card numbers, the card holder’s name, credit card verification codes (CVV), and expiration date.

Hackers love this stuff. The volume and variety of the records exposed gives hackers everything they need to commit all kinds of fraud and mischief. Hotel guests and user of the travel sites are not potential victims of identity theft, phishing and other social engineering attacks, and even financial fraud. But black hat hackers don’t always use the data themselves. More than likely the hacker will sell it off on the dark web in bulk.

If you use Expedia or Booking.com you’ll be hearing from them soon I’m sure. In the mean time you might want to keep an eye on your credit cards and other financial resources.