Two-thirds of hotel websites leak personal data

Confirmation emails are inadvertently sharing booking details with third-party advertisers

Hotel booking on a tablet

Two-thirds of hotel websites inadvertently leak personal data to third-party companies and leave customers vulnerable to hackers.

This is according to research from cyber security firm Symantec, which found that the majority of booking systems used by hotels could allow scammers to access information such as mobile phone and passport numbers.

Advertisement - Article continues below

The leaks come from confirmation emails, sent to customers often containing an unsecured direct link to their booking. The report suggests that anyone on the same network could intercept the email and modify or cancel their reservation.

Principal threat researcher, Candid Wueest, tested the websites of 1,500 hotels from 54 countries and found that two in three of them, or 67%, had the problem. The security lapses are in breach of the EU's GDPR laws, which state that firms must protect the personal data of customers.

"The fact that this issue exists, despite the GDPR coming into effect in Europe almost one year ago, suggests that the GDPR's implementation has not completely addressed how organisations respond to data leakage," said Wueest.

Of the websites Wueest tested, more than half (57%) send confirmation emails to customers with a direct access link to their booking. This is for the convenience of the customer, giving them a simple link to click straight into their reservation without having to log in.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Because these emails require a static link, the booking reference code and the email are sent in the URL itself. This wouldn't be a problem on its own, but most of the websites load additional content on the same website, such as advertisements, meaning that the direct access is shared, either directly with other resources or indirectly through the referrer field in the HTTP request.

There are other scenarios in which the booking data may also be leaked. Some sites pass on the information during the booking process, while others leak it when the customer manually logs into the website. In most cases, Wueest found that the booking data remained visible, even if the reservation has been cancelled, offering up a large window of opportunity for hackers to steal personal information.

There were a number of hotel chains suffering data breaches in 2018, such as the Radisson chain, which had its customer's details accessed via its rewards scheme, and Mariott's Starwood Hotel system, which saw a major flaw discovered in its reservation system.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020