Otelier data breach exposes personal information of millions of guests

Hotel management platform Otelier has been exposed to a data breach, revealing personal information of millions of guests of well-known hotel brands.
Otelier is a service company that provides real-time, cloud-based solutions for hotels to manage reservations, transactions, and invoicing. It has over 10,000 customers worldwide, including Marriott, Hilton, and Hyatt, and employs over 400 people.
The breach occurred in July 2024, when hackers succeeded in exfiltrating 7.8 terabytes of data from Otelier’s Amazon AWS S3 buckets. The attackers initially hacked the company’s Atlassian server using an employee’s login. His login credentials were stolen with the help of infostealing malware.
Once the hackers gained access to the company’s Amazon cloud storage, they scraped millions of documents belonging to the company that contained personal information of millions of customers, including full names, physical addresses, phone numbers, email addresses, guest reservations, and partial credit card numbers. The documents also included nightly hotel reports, shift audits, accounting data, employee emails, and other internal data.
Otelier has confirmed the data breach to BleepingComputer. The company says it has been in touch with affected customers. A team of cybersecurity experts is currently conducting a comprehensive forensic analysis.
“The investigation determined that the unauthorized access was terminated. In order to help prevent a similar incident from occurring in the future, Otelier disabled the involved accounts and continues to work to enhance its cybersecurity protocols,” the company says in a statement.
Marriott is one of the victims that has been impacted by the cyberattack on Otelier. “Marriott has also taken appropriate precautions, including suspending the automated services provided by Otelier until the completion of their investigation, and those services remain suspended,” a spokesperson told BleepingComputer. He stresses that none of the company’s systems were breached in this attack.
According to cybersecurity expert Troy Hunt, who received an extensive set of data, Otelier had 437,000 unique email addresses exposed, of which 80% was already recorded in the Have I Been Pwned database.
Even though no passwords or billing information was stolen, affected customers should still be careful. Scammers could use the stolen information for phishing attacks.
Your email address will not be published. Required fields are marked