Indications that a data breach may have occurred followed the appearance of an advert which is offering a 140 gigabyte data trove in exchange for Bitcoins, with the notice appearing in a region of the dark web.
The personal data initially was selling for 8 Bitcoins (equivalent to about $51,100). The seller, according to the website Hotel Management, has lowered its asking price to 1 Bitcoin. This followed a widespread circulation of the sale.
Given that the data appears to exclusively relate to the Chinese hotel group, an inquiry has begun as to how the data breach may have occurred. Meanwhile, many people remain vulnerable to identity theft.
As an alternative theory to a major hack, some security experts, such as Zibao, are of the view that the customer database could have been accidentally uploaded to the Internet. As the BBC reports, different options are being reviewed by the Shanghai Police. Huazhu Hotels has indicated that the company is cooperating with the police. The hotel group has also employed local security agencies to assist with the investigation.
Commenting on the event, the Shanghai police said in a statement: “Those who commit illegal acts including theft, trading and exchange of residents’ personal data will be heavily punished. We are resolute in protecting people’s interest and ensuring information security.”
Huazhu Hotels (formerly known as the China Lodging Group Limited) are one of the largest hotel chains in China, also brands like Ibis and Mercure in a licensing deal with French based AccorHotels. In all the company has 3,500 different hotels in the country, across 382 mainland cities. Globally it is the twelfth largest hotel group.
According to the Financial Times , many Chinese companies are criticized for having poor data protection systems. This is based on the level of personal information bought and sold in the country, based on a review of online platforms and dark web forums.
