Hotels.com, Expedia provider exposed data for millions of guests
The hotel industry now has a potentially serious security headache on its hands alongside the pandemic. Website Planet reports that Prestige Software, the channel manager that links hotel reservations to sites like Hotels.com, Booking.com and Expedia, left data exposed for “millions” of guests on an Amazon Web Services S3 bucket. The 10 million-plus log files dated as far back as 2013 and included names, credit card details, ID numbers and reservation details.
It’s not certain how long the data was left open, or if anyone took the data. Website Planet said the hole was closed a day after telling AWS about the exposure. Prestige confirmed that it owned the data.
The damage could be severe if crooks found the data. WP warned that it could lead to all too common risks with hotel data exposures like credit card fraud, identity theft and phishing scams. Perpetrators could even hijack a reservation to steal someone else’s vacation.
The practical impact could be limited when few people are traveling during the pandemic. However, this does illustrate the dangers of a heavy reliance on third-party providers for platforms. The security is only as strong as the weakest link in the chain, and a vulnerability at one company risks compromising all of them.
(18)
