Cyber Incident Victim: Hotels.com
Date:
May 2017
Location:
United States of America
Summary
A global hotel booking platform experienced a data breach impacting customers, including Irish users, during a multi-day period where hackers accessed personal information. The compromised data involved names, addresses, and passwords, though the company confirmed full credit card details were not exposed. Cybersecurity experts highlighted the broader risks of stolen credentials being monetized on illicit platforms or exploited through follow-up phishing attempts mimicking breach notifications. The incident underscored ongoing threats to online hospitality services and the persistent targeting of customer databases by malicious actors seeking financially valuable information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Hotels.com data breach occurred between May 22 and May 29, 2017, impacting customers globally, including users in Ireland. Hackers compromised customer data on the hotel booking platform, which operates as part of the Expedia group alongside brands like Trivago and Hotwire. While Hotels.com confirmed the incident, it did not disclose the exact number of affected individuals or provide a geographic breakdown beyond acknowledging Irish customers were among those impacted. The company stated that full credit card information remained secure and was not accessed during the breach. No specifics were provided regarding the methods used by attackers, the exact types of compromised data beyond general customer information, or how the intrusion was detected. Hotels.com engaged with customers worldwide following the discovery, though the timeline for containment and remediation measures was not detailed in available reports.
The incident highlighted broader cybersecurity challenges facing online travel platforms. Industry experts from Irish cybersecurity firms PwC and Smarttech contextualized the breach within persistent threats targeting hospitality and e-commerce sectors. Leonard McAuliffe of PwC noted that databases containing personal identifiers, passwords, and payment details remain prime targets due to their resale value on darknet markets. He also warned about post-breach phishing attempts mimicking legitimate security notifications, advising users to avoid email links for password resets. Ronan Murphy of Smarttech emphasized password hygiene—including regular updates and avoiding credential reuse—as a critical defense. Hotels.com did not publicly confirm whether multi-factor authentication or biometric safeguards were implemented in response, nor did it disclose regulatory notifications or forensic findings. The breach underscored operational risks for Expedia’s subsidiary network without revealing financial or reputational damage metrics.