Luxury hotel chain in Thailand reports data breach

[mikebell]

19 hours ago, Hawaiian said:

Suspect email should be forwarded to [email protected].  They usually acknowledge receipt when I do.  I rarely receive another fraudulent email after that; that is, not for a long time.

 

They always respond automatically to me with no discernable difference.

[superal]

On 10/29/2021 at 10:42 AM, JayClay said:

What hotels are you going to that hold your passport for a day?

 

I have never experienced this before.

            Not too recently I have to say but about 4 or 5 years ago around xmas time the Lek Hotel in Pattaya , a little bit later the Centara hotel in Udon Thani and finally the Pullman in Khon Kaen . However within the last 2 years when staying in Korat and a small hotel in Khon Kaen , my Thai drivers licence was accepted , copied and handed back to me 

[ThailandRyan]

A few more annoying calls today on my Thai phone and then out of the blue a call from Thailand on my US cell phone I use for my business. Appears my profile also listed that phone as well.

[lkn]

Guys, these comments about Thai companies not taking IT security serious, not willing to pay extra for it, or not knowing how to encrypt a database is just ridiculous.

 

Have a look at this rather long list of companies that have suffered data breaches.

 

This is clearly an industry wide problem! And securing a database is not hard, if only one person needs to access it, but a chain with 70 hotels probably need to have hundreds of people able to access customer records, for example if you call their customer support and want to make changes to your booking, etc.

 

From the article it sounds like the servers were compromised, so this might not even be a phishing attack or weak password thing, but possible a vulnerability in some server software. Exploits are found all the time, and even an up-to-date system can be vulnerable to exploits unknown to the vendor.

[jacko45k]

19 hours ago, superal said:

            Not too recently I have to say but about 4 or 5 years ago around xmas time the Lek Hotel in Pattaya , a little bit later the Centara hotel in Udon Thani and finally the Pullman in Khon Kaen . However within the last 2 years when staying in Korat and a small hotel in Khon Kaen , my Thai drivers licence was accepted , copied and handed back to me 

I suspect it is because you could not provide a credit card at check-in, or they were too lazy to go make a copy there and then. It has not been my experience that they need to hold the passport.

[ukrules]

23 hours ago, lkn said:

From the article it sounds like the servers were compromised

Of course they were, so how would you easily encrypt the database in such a way that they (hacker) can only gain access to encrypted data with no keys on the server itself as that would of course defeat the entire purpose of the encryption wouldn't it?