Group byod claims breach of IHG Hotels network
The byod group listed IHG Hotels & Resorts, owner of Holiday Inn and Crowne Plaza, on its leak site and claims theft of guest booking and folio records, employee PII, AWS keys, Active Directory and CyberArk access, and all financial records. The group says it got in through a weak LDAP binding password. IHG has not confirmed an incident and the data has not been verified; guests should be wary of unexpected reservation or payment messages and watch loyalty accounts.
What happened
The byod group listed IHG Hotels & Resorts, owner of Holiday Inn and Crowne Plaza, on its leak site. The group claims access to guest booking and folio records, loyalty program data, complete employee PII, AWS keys, Active Directory and CyberArk access, and all financial records. IHG has not confirmed an incident and the data has not been verified.
Why it matters
If real, guest folio and loyalty data would fuel convincing booking-themed phishing and loyalty-points fraud across IHG brands. The claimed AWS keys and CyberArk access, if genuine, would expose corporate infrastructure and secrets.
What to do
Await an official IHG statement and monitor the leak site. Travelers should be wary of unexpected reservation or payment-update messages and watch their loyalty accounts.
For the technical team
- Affected
- IHG Hotels & Resorts, proprietária de redes como Holiday Inn, Crowne Plaza, Six Senses, Staybridge Suites e Candlewood; · IHG Hotels & Resorts; brands named: Holiday Inn, Crowne Plaza, Six Senses, Staybridge Suites and Candlewood.
- Exploitation
- Threat-actor claim on a leak site, unverified. IHG has not confirmed an incident and the data has not been verified (reported by DailyDarkWeb).
- Fix
- No software to update
- Vector
- Initial vector claimed by the byod group: weak LDAP binding password.
- More details
- Claimed chain: weak LDAP binding password leading to Active Directory access, full CyberArk access, AWS keys and financial records. Claimed data: guest booking and folio records (names, addresses, phone numbers, emails, stay dates, rates and charges), loyalty program data and complete employee PII. Disclosed by DailyDarkWeb.
Timeline
byod group listed IHG on its leak site and claimed broad access to guest, employee and infrastructure data.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
