Chinese media reported (1, 2, 3, 4) that on the darknet, during a hackers’ forum, information on 130 million guests of Chinese hotels had been put up for sale. The information was valued at 8 bitcoins (about 56,000 dollars).
The seller claims the data was obtained from Huazhu Hotels Group Ltd, one of the largest hotel chains in China, which includes 13 different brands (Hanting, Grand Mercure, Joye, Manxin, Novotel, Mercure, CitiGo, Orange, Toutes saisons, Starway, Ibis, Elan, Haiyou) and 5,162 hotels in 1,119 cities across the Middle Kingdom.
According to the description of the “lot,” the dump contains about 141.5 GB of information, including 240 million records on 130 million guests at Huazhu hotels. The following information is provided for each guest: official site registration data (ID number, mobile phone number, email address, login and password);hotel registration data (name, ID number, home address, date of birth); and booking information (name, card number, mobile phone number, hotel check-in date, check-out date, internal hotel identifier, room number).
Huazhu representatives have already published an official statement, which contains no details about the leak, but notes that the incident is under investigation and that law enforcement authorities have already joined the case.
Specialists at Chinese IT security company Zibao said they were able to confirm the authenticity of the data up for sale and declared it genuine. Researchers believe the leak itself occurred earlier this month and that Huazhu employees are responsible for the incident. Specifically, according to Zibao, some of the company’s employees mistakenly uploaded copies of databases to GitHub that were not meant to be seen by prying eyes.
