Cyber Incident Victim: Shangri-La Asia Limited
Date:
Jul 2022
Location:
Hong Kong
Summary
Shangri-La Asia Limited experienced a cybersecurity incident involving unauthorized access to its guest databases, compromising personal information including names, contact details, and passport numbers. The hospitality group promptly secured affected systems, launched an investigation with external cybersecurity experts, and notified impacted customers and regulatory authorities. Operations continued with minimal disruption as the organization implemented enhanced security measures and offered identity monitoring services to affected individuals. The incident underscored vulnerabilities in third-party data handling processes within the hospitality sector.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around July 1, 2022, Shangri-La Asia Limited publicly disclosed a cybersecurity incident involving unauthorized access to its IT systems. The breach was initially detected in late May 2022 when anomalous activity was observed within certain guest databases. Subsequent forensic investigations revealed threat actors had infiltrated servers storing customer information across multiple hotels and resorts operated by the group. The attackers deployed ransomware and exfiltrated data before encrypting files, though the company did not specify the ransomware variant involved. Shangri-La immediately engaged external cybersecurity experts to contain the breach and initiated system-wide security enhancements while maintaining hotel operations through manual workarounds during the remediation period.
The incident compromised personally identifiable information of guests including names, email addresses, phone numbers, and Shangri-La Circle loyalty program membership details. No evidence suggested credit card information or passport data was accessed. The breach affected properties across eight countries in Asia and the Middle East, necessitating notifications to regulatory authorities in all relevant jurisdictions. Operational disruptions lasted approximately three weeks while systems were restored from backups, with the company incurring significant incident response costs. Long-term consequences included potential reputational damage from the exposure of customer data and increased scrutiny of the hospitality sector's cybersecurity practices. Shangri-La implemented additional security controls and monitoring systems following forensic analysis of the attack vectors.