The Best Western Hotel Group had more than bathroom towels ripped off over the past year. According to reports over 8 million guest records were nabbed by hackers and, according to authorities, many of the hotel patrons personal information, including home addresses, phone numbers, place of employment and credit card details, are now for sale by the Russian Mafia.
The investigation led by The Sunday Herald discovered late last week that a previously unknown Indian hacker managed to breach the online booking system of the Best Western Hotel group, one of the largest hotel chains in the world.
The Indian hacker managed to gather the personal details of every customer booked into any of the Best Western group's hotels since 2007 and the stolen data contains addresses, telephone numbers, credit card details and employment places of Best Western hotel guests.
The Indian hacker, a new presence in the cyber-crime world, managed to bypass Best Western's software security and placed a Trojan horse viruses on one Best Western computers used for reservations. From there, the hacker was able to collect Best Western staff members' login details, making it easy to gather guests' data.
TSH found out about the breach on Thursday last week and alerted Best Western about it on Friday, when the hotel group closed the hole in its security system. The company said that it is taking appropriate action to tackle the breach, but worries emerged about how the vast amount of stolen information can be used.
The stolen details of Best Western's hotels were put up for sale on an underground website said to be operated by a branch of the Russian mafia. TSH says the gang specializes in Internet crime and offers heavily guarded and untraceable web hosting services. Experts commissioned by TSH fear that the information gained from Best Western is already used for criminal strategies.
When it comes down to the numbers, FBI's Internet Crime Complaint Center says that an average Internet crime victim loses about $700 so the Best Western hackers could get their hands on over $5 billion.
Best Western now says only a handful of records were compromised, not millions. Data security investigations are complex, and they require patience. As we learned from the TJX experience, it is easy for the press and for authorities to over-react. --Ben http://legal-beagle.typepad.com/wrights_legal_beagle/2008/08/credit-card-iss.html