Best Western Loses Details On 8 Million Customers

Albanach writes "Scotland's Sunday Herald newspaper has an exclusive report that the Best Western hotel chain has lost the personal details of each and every guest who has stayed at any of its 1300 hotels in the past 12 months. This amounts to details on 8 million customers and includes information such as name, address, credit card details and employment details. The data even includes future booking details, causing speculation that homes could be targeted for burglary when it's anticipated they will be unoccupied. A Best Western spokesperson is quoted as saying 'Best Western took immediate action to disable the compromised log-in account in question. We are currently in the process of working with our credit card partners to ensure that all relevant procedural standards are met, and that the interests of our guests are protected.'"

Comments

What is a continental hotel?

[Renegade Lisp]

The Sunday Herald article is amazingly unclear about the scope of this breach. Which hotels are affected? The article says all "continental hotels". Does that, from a British Newspaper, mean european continental hotels only?

I stayed at Best Western in the US late last year. Luckily, I have since then changed to a different credit card than the one I used at the time.

The last time when a company I did business with lost my credit card details, I decided I wouldn't do anything about it until I really saw an unauthorized withdrawal from my account. Because in the past, when there was an unauthorized withdrawal (only happened to me once), a single phone call to the credit card company had been enough to get my money back (some 300 Euro). They said they would start to investigate it, but because it could take a long time, "here's your money back as a first measure."

With the recently stolen card info, I got a notice from my bank a few months later that they had to disable my card because there was an attempt to commit fraud with it. I got a new card with no further action required on my part.

Either way, this could turn out to be a big hassle for Best Western. If only they could let me know if my personal data was affected.

Just a nitpick

[CaptainZapp]

Even though Best Western can be seen as a "chain" it's actually a marketing umbrella for thousands of independent hotels.

From here :

Unlike other chains, which are often a mix of company-owned and franchised units, each Best Western hotel is an independently owned and operated franchise. Best Western does not offer franchises in the traditional sense (where both franchisee and franchisor are operating for-profit), however. Rather, Best Western operates as a nonprofit membership association, with each franchisee acting and voting as a member of the association.

Re:Bad Summary

[ralphdaugherty]

This whole thing is very confusing to make sense of, starting with British writers that write like the National Enquirer.

Starting at the beginning, from TFA, someone from India "planted a trojan virus on one of the [continental] Best Western Hotel machines used for reservations" collecting the username and login of a staff person's login.

So what does that give them? A log in to the Best Western reservations system. Gee, wonder how many people know that top secret info? Like every freakin Best Western counter clerk, for starters.

And then what does one do when logged in to a reservations system? They make reservations!!! Holy cow, that's top secret too.

So here's where it gets confusing. How does someone knowing the login to a reservations system, which is like everyone using it, allow anyone who's logged in to acquire the entire reservations history table?

If anyone can do it by selecting history on all or something, then any Best Western clerk could have retrieved all this info at any time just by logging in.

With the trojan virus hocus pocus talk, there is an implied possibility that the virus spread to the server which provided a back door to retrieve the info, but that isn't stated. What's stated is the that the trojan merely recorded a login and the Indian got it. We know that is what is happening in bot networks all over the world. It's just a matter of which logins get snapped up from an unsuspecting user.

So either any Best Western clerk could retrieve all reservation history including credt card info at any time, in which case the Indian might just as well worked for one, or there's an unspecified and unexplained access to the server that provided a backdoor FTP from the server.

One or the other, but if the first then it wouldn't be the greatest cyber-crime ever, it would be the worst reservation system server software in history.

If the second, again, a clerk could have copied a trojan virus file from a floppy to the reservations PC and logged in, doesn't require a "hacker" at all.

My guess from the frenzied journalism is that a reservations clerk login is all it took rather than hoping the trojan virus could both capture the login and then also migrate successfully to the server, which trojans generally aren't multi-OS aware and assuming the server was the same OS, migrated with standard trojan attack vectors for the OS. I find that hard to believe though.

I also wonder whether there were any confirmed sightings of the info being offered in criminal forums by any of these quoted security experts or just how it came to be known that the entire reservations history table has been downloaded by anyone who acquired the reservations system login from the Indian.

Gee, having a Best Western reservations system login being the cyber-crime of the century is the goofiest thing I've seen since the last /. debacle thread, and we don't have to go too far back to find one.

  rd