Inghams

Summary

Hotelplan UK experienced a cyber attack that prompted the isolation and shutdown of key systems while an investigation is underway. The company said it is working to restore services and has introduced workarounds to limit disruption, noting that already booked holidays remain unaffected but delays could occur and individual brands may return to full operation at different times.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hotelplan UK reported a cyber security incident that occurred over the weekend, prompting the company to launch an investigation and to isolate and shut down key systems. The statement issued on Tuesday confirmed that the IT disruption stemmed from a cyber attack affecting the group. Hotelplan UK, which operates the brands Inghams, Explore Worldwide, Esprit Ski, Inntravel and Santa’s Lapland, said it was carrying out a thorough investigation while working to restore service levels. The company emphasized that it had taken immediate steps to contain the incident by disconnecting affected systems.

Chief executive Joe Ponte stated that there would be no impact on holidays and trips that were already booked, and that customers were still departing as normal. He noted that travel agents could continue to make contact with the group through the usual channels, although workarounds were being introduced to minimise disruption. Ponte warned that delays might be encountered over the coming days as the restoration process continued. He also indicated that different brands within the group might become fully operational at different times, reflecting the staggered recovery effort.

Ponte said the team was working around the clock to get all brands fully operational again and to resume the expected level of service for agents, partners and customers. He expressed regret for any inconvenience caused and thanked agents and partners for their support during the incident. The company reiterated that it takes all matters of cyber security extremely seriously and would continue its investigation until normal operations were fully restored.

Sources

Sources available to members: 1 source.