Lodge administration platform Otelier suffered an information breach after risk actors breached its Amazon S3 cloud storage to steal tens of millions of visitors’ private info and reservations for well-known lodge manufacturers like Marriott, Hilton, and Hyatt.
The breach first allegedly occurred in July 2024, with continued entry by means of October, with the risk actors claiming to have stolen amost eight terabytes of knowledge from Otelier’s Amazon AWS S3 buckets.
In an announcement to BleepingComputer, Otelier confirmed the compromise and stated it’s speaking with impacted clients.
“Our high precedence is to safeguard our clients whereas enhancing the safety of our methods to stop future points,” Otelier instructed BleepingComputer.
“Otelier has been in communications with its clients whose info was probably concerned. In response to this incident, we employed a staff of main cybersecurity specialists to carry out a complete forensic evaluation and validate our methods.”
“The investigation decided that the unauthorized entry was terminated. With a view to assist forestall an identical incident from occurring sooner or later, Otelier disabled the concerned accounts and continues to work to reinforce its cybersecurity protocols.”
Otelier, beforehand often called MyDigitalOffice, is a cloud-based lodge administration answer utilized by over 10,000 lodges worldwide to handle reservations, transactions, nightly stories, and invoicing.
The corporate is or has been utilized by many well-known lodge manufacturers, together with Marriott, Hilton, and Hyatt, whose knowledge is current within the stolen info.
Breached by means of stolen credentials
The risk actors behind the Otelier breach instructed BleepingComputer that they initially hacked the corporate’s Atlassian server utilizing an worker’s login. These credentials have been stolen by means of information-stealing malware, which has develop into the bane of company networks over the previous few years.
When BleepingComputer requested Otelier to verify this info, an organization consultant stated they might not share any additional feedback on the incident. Nevertheless, BleepingComputer discovered on the Flare risk intelligence platform Otelier worker info that had been stolen by infostealer malware.
The risk actors say they used these credentials to scrape tickets and different knowledge, which contained additional credentials to the corporate’s S3 buckets.
Utilizing this entry, the hackers claimed to have downloaded 7.8TB of knowledge from the corporate’s Amazon cloud storage, together with tens of millions of paperwork belonging to Marriott that have been in S3 buckets managed by Otelier. These paperwork embrace nightly lodge stories, shift audits, and accounting knowledge.
Marriott has confirmed to BleepingComputer that Otelier’s cyberattack has impacted them and suspended automated providers whereas Otelier completes its investigation. The corporate stresses that none of its methods have been breached on this assault.
“As soon as we have been made conscious of this incident involving Otelier, we instantly contacted the seller, which works with quite a few lodge firms, and confirmed that they have been working with cyber safety specialists to research a safety incident that impacted their methods,” a Marriott spokesperson instructed BleepingComputer.
“Marriott has additionally taken acceptable precautions, together with suspending the automated providers supplied by Otelier till the completion of their investigation, and people providers stay suspended.”
The risk actor says they tried to extort Marriott, considering the S3 buckets belonged to them, and left ransom notes requesting fee in cryptocurrency to not leak the info. Nevertheless, no communication was made, and so they stated they misplaced entry in September after credentials have been rotated.
Whereas Marriott instructed BleepingComputer that there aren’t any indications that delicate info was stolen within the breach, samples of the stolen knowledge shared with BleepingComputer and Have I Been Pwned’s Troy Hunt include lodge visitors’ private info.
The small samples seen by BleepingComputer embrace a broad vary of knowledge, together with lodge visitor reservations, transactions, worker emails, and different inside knowledge.
A number of the private info uncovered consists of lodge visitors’ names, addresses, telephone numbers, and electronic mail addresses.
The stolen knowledge additionally consists of info and electronic mail addresses associated to Hyatt, Hilton, and Wyndham. BleepingComputer contacted Hyatt and Hilton concerning the breach however didn’t obtain a response.
Troy Hunt instructed BleepingComputer that he obtained an intensive set of knowledge, with the reservations desk containing 39 million rows and a customers desk with 212 million.
Hunt says that regardless of the big set, he discovered 1.3 million distinctive electronic mail addresses, as many are repeated.
The uncovered private info is being added to Have I Been Pwned, permitting anybody to verify if their electronic mail tackle is within the uncovered knowledge.
The excellent news is that passwords and billing info don’t seem to have been stolen within the assault, however risk actors might nonetheless use this info in focused phishing assaults.
Subsequently, you need to be looking out for suspicious emails impersonating lodge manufacturers impacted by this breach.
