A hotel software provider has exposed the personal data of millions of guests around the world after misconfiguring an AWS bucket, according to a new report from Website Planet.
The tech site’s security team discovered an exposed cloud database belonging to Spanish developer Prestige Software, whose platform enables hotels to automate their availability on booking websites like Expedia.
The misconfigured S3 bucket contained over 10 million individual log files, dating back to 2013. Website Planet researcher, Mark Holden, warned that the total number of affected individuals could be even greater than this, as some logs contained personally identifiable information (PII) for multiple members of a single booking.
Among the leaked data were full names, email addresses, national ID numbers and the phone numbers of hotel guests. For hundreds of thousands of individuals card booking details including card number, cardholder’s name, CVV and expiration date were also exposed.
Prestige’s Cloud Hospitality platform appears to be used by many of the top online travel agent (OTA) sites out there including Agoda, Expedia, Booking.com and Hotels.com.
Website Planet reached out to AWS directly to disclose the incident, which was fixed the day after. Prestige Software also confirmed to it that it is the owner of the data.
The leaked information could have offered malicious third parties a trove of data to commit identity fraud, launch follow-on phishing attacks and even hijack and change booking details.
As a result, the Spanish developer may face questions from GDPR and PCI DSS investigators over the incident.
“Millions of people were potentially exposed in the data breach, from all over the world. We can’t guarantee that somebody hasn’t already accessed the S3 bucket and stolen the data before we found it,” argued Holden.
“So far, there is no evidence of this happening. However, if it did, there would be enormous implications for the privacy, security and financial wellbeing of those exposed.”
"hotel" - Google News
November 09, 2020 at 04:45PM
https://ift.tt/3nj1aWD
Hotel Booking Firm Leaks Data on Millions of Guests - Infosecurity Magazine
"hotel" - Google News
https://ift.tt/3aTFdGH
https://ift.tt/2xwvOre
Bagikan Berita Ini
0 Response to "Hotel Booking Firm Leaks Data on Millions of Guests - Infosecurity Magazine"
Post a Comment