Cyber Incident Victim: Google
Date:
Aug 2016
Location:
United States of America
Summary
A breach impacting Google employees occurred via a third-party travel service provider's compromised reservation platform, exposing personal and payment card information. The unauthorized access stemmed from a security incident at a hospitality solutions provider used by travel agencies, affecting data processed during work-related bookings. Due to the system's data retention policies, the exact scope of accessed records per individual could not be determined. The company offered affected personnel identity protection and credit monitoring services. This incident followed an earlier third-party exposure involving employee benefit data, highlighting risks associated with vendor ecosystems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The breach impacting Google employees originated from a compromise of Sabre Hospitality Solutions' SynXis Central Reservation System, a platform utilized by tens of thousands of hotels globally to manage reservations through travel agencies. Unauthorized access to Sabre's systems occurred between August 10, 2016, and March 9, 2017, during which an attacker exfiltrated personal data including employee contact details and payment card information. The breach was initially identified through Sabre's SEC filings in early May 2017 by security researcher Brian Krebs. Sabre subsequently notified its clients, including Carlson Wagonlit Travel (CWT), Google's designated corporate travel management provider. CWT then alerted Google to the potential exposure of employee data related to work-related hotel bookings processed through the compromised SynXis platform. Due to Sabre's 60-day data retention policy for reservation records, Google could not definitively ascertain which specific employee records were accessed during the attacker's prolonged presence in the system.
Google initiated notifications to affected employees in July 2017, clarifying that the breach stemmed from a third-party vendor rather than internal security failures. The company offered two years of complimentary identity protection and credit monitoring services to mitigate potential financial fraud risks. While the incident involved a limited number of staff compared to broader corporate breaches, it underscored persistent third-party risks. This marked at least the second exposure of Google employee data via external vendors within a year, following a May 2016 incident where a benefits manager erroneously transmitted a file containing names and Social Security numbers to an unauthorized recipient. The Sabre breach had wider industry implications, prompting advisories for all travelers who booked accommodations through agencies using SynXis during the intrusion period to verify potential data exposure.