Advertisement

Too many hotel websites leak personal data: Symantec say

Too many hotel websites leak personal data: Symantec say

Two-thirds of hotel websites inadvertently leak personal data to third-party companies and leave customers vulnerable to hackers.

This is according to research from cyber security firm Symantec, which found that the majority of booking systems used by hotels could allow scammers to access information such as mobile phone and passport numbers.

The leaks come from confirmation emails, sent to customers often containing an unsecured direct link to their booking. The report suggests that anyone on the same network could intercept the email and modify or cancel their reservation.

Principal threat researcher, Candid Wueest, tested the websites of 1,500 hotels from 54 countries and found that two in three of them, or 67%, had the problem. The security lapses are in breach of the EU's GDPR laws, which state that firms must protect the personal data of customers.

Advertisement
Norton by Symantec 728x90

"The fact that this issue exists, despite the GDPR coming into effect in Europe almost one year ago, suggests that the GDPR's implementation has not completely addressed how organisations respond to data leakage," said Wueest.

Of the websites Wueest tested, more than half (57%) send confirmation emails to customers with a direct access link to their booking. This is for the convenience of the customer, giving them a simple link to click straight into their reservation without having to log in.

Because these emails require a static link, the booking reference code and the email are sent in the URL itself. This wouldn't be a problem on its own, but most of the websites load additional content on the same website, such as advertisements, meaning that the direct access is shared, either directly with other resources or indirectly through the referrer field in the HTTP request.

There are other scenarios in which the booking data may also be leaked. Some sites pass on the information during the booking process, while others leak it when the customer manually logs into the website. In most cases, Wueest found that the booking data remained visible, even if the reservation has been cancelled, offering up a large window of opportunity for hackers to steal personal information.

Leave a comment

Make sure you enter all the required information, indicated by an asterisk (*). HTML code is not allowed.

back to top

Top Cyber News

Telia tracks network data for smarter cities in northern Europe

Telia tracks network data for smarter cities in northern Europe

28 March, 2019

It uses aggregated, anonymised phone data to monitor crowd patterns.

Fibre reacts autonomously for the first time to changing net conditions

Fibre reacts autonomously for the first time to changing net conditions

06 March, 2019

The live field trial showcased fibre optic transmission systems autonomously adapting to changing network conditions in ...

Cryptominers Still Top Threat but Coinhive's Shutdown Could Change That

Cryptominers Still Top Threat but Coinhive's Shutdown Could Change That

12 March, 2019

Coinhive has remained on top of Check Point Software's global threat index for the last 15 months. ...

Just under half of A.I. start-ups in Europe have almost nothing to do with A.I., research finds

Just under half of A.I. start-ups in Europe have almost nothing to do with A.I., research finds

05 March, 2019

Nearly half of the companies in Europe that call themselves AI start-ups don't in fact use artificial intelligence, a ne...

Blockchain spending in Europe will be $800 million this year

Blockchain spending in Europe will be $800 million this year

01 April, 2019

The findings were published in IDC's latest Worldwide Semiannual Blockchain Spending Guide. ...

Cyber Threats can target 20% of home PCs running worldwide: Says report

Cyber Threats can target 20% of home PCs running worldwide: Says report

12 March, 2019

According to the intelligence gathered from Avast Threat Detection Database, one in five home PCs running worldwide ar...

Categories

External Links

About Us

Follow Us