Scottish Sunday

EXCLUSIVE: Scottish Sunday uncovers theft of data from every guest in 1300 Best Western Hotels in the past 12 months

An International Cyber-Crime Exposes Millions to Identity Theft

An international criminal gang has executed one of the most audacious cyber-crimes in history by stealing the identities of an estimated eight million people. Late on Thursday night, a previously unknown Indian hacker breached the IT defenses of the Best Western Hotel group's online booking system and sold access details through an underground network operated by the Russian mafia. The stolen data includes personal information such as home addresses, phone numbers, credit card details, and place of employment, amounting to a complete identity-theft kit.

A Cyber-Heist of Unprecedented Magnitude

Security expert Jacques Erasmus, who works for computer security firm Prevx, stated that the volume and quality of the stolen information make this cyber-heist particularly rare. The Russian criminal gangs who specialize in this type of cybercrime will have immediately begun exploiting the information for illegal activities. With enough data in their possession, the stolen identities can be used to commit various criminal strategies, including making high-value purchases, applying for loans and credit agreements, and even planning burglaries using customers' future bookings.

The Breach and its Fallout

The breach in Best Western's system occurred when the Indian hacker placed a Trojan virus on a reservation machine, collecting login details of a staff member. These stolen login credentials were then sold on an underground website operated by the Russian mafia. Using this information, hackers estimated it would take less than an hour to write a software bot capable of harvesting every record on Best Western's European reservation system, providing access to the personal information of millions of guests.

Best Western's Response

Best Western Hotels was alerted about the security breach by the Scottish Sunday and took immediate action to close the breach. They disabled the compromised login account and are working with credit card partners to ensure the necessary procedures are followed and customer interests are protected. Best Western assures customers that they are taking appropriate action to investigate the root cause of the issue and address the third-party website allegedly involved in the illegal exchange of information.

Hotels and the Challenge of Cybersecurity

This cyber-crime incident serves as a stark reminder of the vulnerabilities faced by companies in the hospitality industry, particularly when it comes to cybersecurity. Hotels hold vast amounts of personal and financial information about their guests, making them attractive targets for cybercriminals. It is essential for hotels to have robust security measures in place to protect this sensitive data and to respond swiftly in the event of a data breach.

While hotels strive to offer their guests a safe and comfortable experience, the digital era has introduced new challenges. As technology becomes increasingly integrated into hotel operations, including online booking systems and guest databases, the risk of cyber-attacks grows. Hotel chains must invest in state-of-the-art security systems, regular vulnerability assessments, and comprehensive employee training to combat the evolving threat landscape.

Additionally, partnerships with cybersecurity firms can provide hotels with expert guidance and support in developing and implementing effective security measures. Proactive monitoring and threat intelligence systems can detect and prevent potential breaches before they occur, safeguarding the privacy and personal information of guests.

Hotel guests also play a crucial role in protecting their own data. It is important for individuals to exercise caution when sharing personal information online and to regularly review their financial statements for any suspicious activity. By practicing good cybersecurity hygiene and remaining vigilant, guests can reduce the risk of falling victim to identity theft.