Pierluigi Paganini
November 10, 2020
Researchers at Website Planet discovered a misconfigured S3 bucket used by the Prestige Software’s Cloud Hospitality that exposed millions of hotel guests worldwide.
The reservation system Prestige Software’s “Cloud Hospitality” allows operators at hotels to integrate their reservation systems with online booking websites like Booking.com.
The unsecured cloud repository used by the hotel reservation platform has exposed 10 million files (24.4 GB worth of data) related to guests at various hotels around the world.
Exposed data, some of which go back to 2013, include sensitive information and credit card details.
In some cases, each record contained data for multiple hotel guests that were part of a single reservation.
“Courtesy of our security team at Website Planet, we can reveal that a hotel reservation platform has been exposing highly sensitive data from millions of hotel guests worldwide, dating as far back as 2013 and including credit card details for 100,000s of people.” reads a post published by Website Planet. “The company was storing years of credit card data from hotel guests and travel agents without any protection in place, putting millions of people at risk of fraud and online attacks.”
The experts revealed that the unsecured S3 bucket contained over 180,000 records from August 2020 alone.
The exposed records include full names, email addresses, national ID numbers and phone numbers of hotel guests, card numbers, cardholder names, CVVs and expiration dates, the total cost of hotel reservations, reservation number, dates of a stay, special requests made by guests, number of people, guest names and more.
According to the experts. the data leak affects a large number of reservation platforms, including Amadeus, Booking.com, Expedia, Hotels.com, Hotelbeds, Omnibees, and Sabre.
The availability of such kind of data could expose hotel guests to a wide range of malicious activities, including identity theft, phishing attacks, scams, malware attacks, and reservation takeover.
The researchers pointed out that Prestige could face penalties in case authorities will determine violations of the General Data Protection Regulation and the Payment Card Industry Data Security Standard (PCI DSS).
At the time of publishing this post, it is not clear if someone has access to the S3 bucket.
“We can’t guarantee that somebody hasn’t already accessed the S3 bucket and stolen the data before we found it,” concludes the experts. “So far, there is no evidence of this happening. However, if it did, there would be enormous implications for the privacy, security and financial wellbeing of those exposed.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Prestige)
[adrotate banner=”5″]
[adrotate banner=”13″]
Data Breach / November 21, 2024
