Threat actor claims Hilton central server breach, demands 2 BTC
A threat actor on a dark web forum claims to have breached a central server of Hilton and to hold data on all customers, sharing CSV files and screenshots as proof. The actor demands 2 BTC within 10 days to delete the data, or the full database will be sold publicly for 0.5 BTC. The claim is unverified and Hilton has not commented; Hilton Honors members should watch for fake reservation or loyalty-points emails.
What happened
A threat actor on a dark web forum claims to have breached a central server of Hilton, the global hotel chain, and to hold data on all customers. The actor shared CSV files and screenshots as proof. They demand 2 BTC within 10 days, or the database will be sold for 0.5 BTC.
Why it matters
The claim is unverified and Hilton has not commented. If authentic, guest personal data could fuel targeted phishing and booking scams, according to the report. The source's analyst notes that all-customers claims against major brands are often exaggerated.
What to do
Monitor official Hilton statements and await independent verification. Warn customers and loyalty program members about fake reservation and loyalty-points emails.
For the technical team
- Affected
- Hilton, rede global de hotéis; alegada invasão de servidor central com dados de todos os clientes; extorsão de 2 BTC · Hilton, global hotel chain (claimed central server); systems and versions not specified.
- Exploitation
- Extortion claim posted on a dark web forum and reported by DailyDarkWeb. Not independently verified; Hilton has not commented.
- Fix
- Not applicable; the source cites no fix or technical mitigation.
- Vector
- Claimed breach of a central Hilton server; the access method is not described in the source.
- More details
- Proof shared: CSV files and screenshots. 10-day deadline to pay 2 BTC and delete the data; otherwise the full database will be sold publicly for 0.5 BTC. Analyst note in the source: the low resale price is a caution flag and all-customers claims are often exaggerated; if authentic, guest PII could fuel targeted phishing and booking scams.
Timeline
Underground post claims a Hilton central server breach with all-customer data and a 2 BTC extortion demand.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
