Resort administration platform Otelier suffered an information breach after risk actors breached its Amazon S3 cloud storage to steal tens of millions of visitors’ private data and reservations for well-known resort manufacturers like Marriott, Hilton, and Hyatt.
The breach first allegedly occurred in July 2024, with continued entry by October, with the risk actors claiming to have stolen amost eight terabytes of information from Otelier’s Amazon AWS S3 buckets.Â
In a press release to BleepingComputer, Otelier confirmed the compromise and stated it’s speaking with impacted clients.
“Our prime precedence is to safeguard our clients whereas enhancing the safety of our methods to stop future points,” Otelier advised BleepingComputer.
“Otelier has been in communications with its clients whose data was probably concerned. In response to this incident, we employed a workforce of main cybersecurity specialists to carry out a complete forensic evaluation and validate our methods.”
“The investigation decided that the unauthorized entry was terminated. With a view to assist forestall an identical incident from occurring sooner or later, Otelier disabled the concerned accounts and continues to work to boost its cybersecurity protocols.”
Otelier, beforehand referred to as MyDigitalOffice, is a cloud-based resort administration answer utilized by over 10,000 accommodations worldwide to handle reservations, transactions, nightly studies, and invoicing.
The corporate is or has been utilized by many well-known resort manufacturers, together with Marriott, Hilton, and Hyatt, whose information is current within the stolen data.
Breached by stolen credentials
The risk actors behind the Otelier breach advised BleepingComputer that they initially hacked the corporate’s Atlassian server utilizing an worker’s login. These credentials have been stolen by information-stealing malware, which has grow to be the bane of company networks over the previous few years.
When BleepingComputer requested Otelier to substantiate this data, an organization consultant stated they may not share any additional feedback on the incident. Nevertheless, BleepingComputer discovered on the Flare risk intelligence platform Otelier worker data that had been stolen by infostealer malware.
The risk actors say they used these credentials to scrape tickets and different information, which contained additional credentials to the corporate’s S3 buckets.
Utilizing this entry, the hackers claimed to have downloaded 7.8TB of information from the corporate’s Amazon cloud storage, together with tens of millions of paperwork belonging to Marriott that have been in S3 buckets managed by Otelier. These paperwork embody nightly resort studies, shift audits, and accounting information.
Marriott has confirmed to BleepingComputer that Otelier’s cyberattack has impacted them and suspended automated companies whereas Otelier completes its investigation. The corporate stresses that none of its methods have been breached on this assault.
“As soon as we have been made conscious of this incident involving Otelier, we instantly contacted the seller, which works with quite a few resort corporations, and confirmed that they have been working with cyber safety specialists to research a safety incident that impacted their methods,” a Marriott spokesperson advised BleepingComputer.
“Marriott has additionally taken applicable precautions, together with suspending the automated companies offered by Otelier till the completion of their investigation, and people companies stay suspended.”
The risk actor says they tried to extort Marriott, considering the S3 buckets belonged to them, and left ransom notes requesting fee in cryptocurrency to not leak the info. Nevertheless, no communication was made, and so they stated they misplaced entry in September after credentials have been rotated.
Whereas Marriott advised BleepingComputer that there are not any indications that delicate data was stolen within the breach, samples of the stolen information shared with BleepingComputer and Have I Been Pwned’s Troy Hunt include resort visitors’ private data.
The small samples seen by BleepingComputer embody a broad vary of information, together with resort visitor reservations, transactions, worker emails, and different inside information.
Among the private data uncovered consists of resort visitors’ names, addresses, telephone numbers, and e mail addresses.
The stolen information additionally consists of data and e mail addresses associated to Hyatt, Hilton, and Wyndham. BleepingComputer contacted Hyatt and Hilton in regards to the breach however didn’t obtain a response.
Troy Hunt advised BleepingComputer that he obtained an in depth set of information, with the reservations desk containing 39 million rows and a customers desk with 212 million.
Hunt says that regardless of the big set, he discovered 1.3 million distinctive e mail addresses, as many are repeated.
The uncovered private data is being added to Have I Been Pwned, permitting anybody to test if their e mail deal with is within the uncovered information.
The excellent news is that passwords and billing data don’t seem to have been stolen within the assault, however risk actors might nonetheless use this data in focused phishing assaults.
Due to this fact, you ought to be looking out for suspicious emails impersonating resort manufacturers impacted by this breach.
