-
A new hacker group called BYOD says it stole guest, loyalty, employee and financial data from IHG. It has posted no proof.
-
IHG has not made any public statement confirming a breach, so the hacker group’s claim remains unverified.
-
Guests should doubt unexpected booking or payment messages and watch their loyalty accounts.
A hacker group calling itself BYOD says it broke into IHG Hotels & Resorts. IHG owns Holiday Inn, Crowne Plaza, Six Senses, Staybridge Suites and Candlewood Suites.
The group listed the company on its leak site on November 3. However, as of Wednesday, November 4, IHG had not publicly confirmed any incident.
The Hackers Allegedly Stole Customer Data and Other Sensitive Information
The post mocks IHG over a weak password. It claims the company guarded its LDAP with a very simple one. LDAP is a system that decides who can connect to a company network.
Next, the group lists what it says it holds. That includes customer data and AWS keys, which open cloud accounts. It also claims full access to CyberArk, a tool that guards staff passwords. The list adds complete employee records, a loyalty data store and all financial records.
The booking data allegedly covers guest names, billing addresses and company names. It also lists rate codes, room charges, taxes, spending, hotel names and stay dates.
Reservation and payment records reportedly add phone numbers, emails, and arrival and departure dates. Finally, the group claims access to Active Directory, which controls who can log in to company computers.
The group also says changing passwords will not stop it, because getting back onto the network is easy. In addition, it wants IHG to start talks and promises to remove the listing once they begin. However, Cyber Daily reports that the hackers posted no evidence. No one has verified any of it.
A Brief Background on the Hacker Group BYOD
BYOD emerged in September. Cyber Daily counts only five alleged victims on its leak site so far. The Register calls it a ransomware-as-a-service operation, meaning it may rent its tools to other criminals.
Its best-known claim involves Trump Mobile. BYOD posted records on 3,615 Trump Mobile customers, including names, emails, phone numbers and home addresses. PCMag said they reached three people in the file, and they confirmed they had used Trump Mobile. The company has not confirmed the breach.
Its best-known claim involves Trump Mobile. BYOD claimed to have exposed personal data belonging to 3,615 Trump Mobile users, including names, emails, phone numbers and home addresses. The group posted records that reportedly contained these details. PCMag said it reached three people in the file, and they confirmed they had used Trump Mobile. The company has not confirmed the breach.
Michigan State University also appears on the list. The school said on November 3 that it is investigating a possible threat. So far, it has found no sign that anyone exposed personal data.
BYOD also claimed an attack on the University of New Mexico Health Sciences Center. That attack forced ambulances to divert and the school to cancel classes. Later, the group apologized. It said it had not known the systems helped treat patients. It also offered hospitals a free unlock key.
Experts say the group appears legitimate so far. Still, its short record makes the IHG claim hard to judge.
IHG has Faced Cyber Attacks Before
In late 2016, IHG began investigating payment card fraud at some hotels in the US. Also, in 2020, IHG agreed to pay over $1.5 million in settlement in a class action lawsuit tied to a past breach.
Then, in September 2022, hackers disrupted IHG’s booking websites and app. On September 6, IHG told the London Stock Exchange that parts of its systems had seen unauthorized activity. A couple from Vietnam told the BBC they got in through a weak password and wiped data for fun. IHG said outside experts found no evidence that hackers reached systems holding guest data.
Franchise owners sued IHG in federal court in Atlanta on September 15. They claimed that the outage caused them to lose millions of dollars in lost revenue. Nothing in the reports links that attack to BYOD.
However, the scale is a cause for concern. Cyber Daily says the employee claim could touch over 380,000 people across more than 6,800 hotels. That includes 69 in Australia. Therefore, a real breach could reach many people in many countries.
What’s Next for Guests?
If the claim holds, scammers would gain a useful tool. An email that names your real hotel and stay dates looks convincing. Likewise, thieves could go after IHG One Rewards points.
First, refrain from clicking on any links that are present in an email regarding an unrequested booking or payment. Rather, use the IHG app or enter the website URL yourself. Also, call up the hotel on a number you find on their official website.
Always make sure not to reuse your account password anywhere else. Last but not least, always monitor your points balance and credit card statements.
Two things will settle this. One is a statement from IHG. The company filed a notice with the London Stock Exchange in 2022, so a similar filing is possible. The other is sample data from BYOD. Reporters can check samples against real customers, as many publications did with Trump Mobile.
Until then, the claim is only a claim. The details are specific, and the group has some track record. Specific claims can still be false, though. Guests lose nothing by staying alert.
