main
Report a problem

Hackers breach Best Western in data heist

Tom Warren   on 25 August 2008 - 13:08 · 41 comments & 14613 views

Advertisement (Why?)
Hackers have broken into the corporate databases for best Western Hotels and may have stolen the names, addresses and credit card information of every customer who stayed with the international group since 2007.

An investigation by the Sunday Herald found that an unknown Indian hacker got into Best Western’s databases on Thursday and accessed its databases, which contain the names, addresses, credit card numbers and additional customer’s information of people who have used the chain internationally.

"Best Western took immediate action to disable the compromised log-in account in question. We are currently in the process of working with our credit card partners to ensure that all relevant procedural standards are met, and that the interests of our guests are protected," said a spokesman.

"We continue to investigate the root cause of the issue, including, but not limited to, the third-party website that has allegedly facilitated this illegal exchange of information."

The data on how to get into the database was apparently provided by an Eastern European hacking group and although the security hole the hacker used has now been closed the potential losses to customers could be huge.

View: Vnunet

Post a comment · Send to friend Comments · There are 41 additional comments
(3 replies) #1 GOJI_GKing2000 on 25 Aug 2008 - 14:28
That's right folks, pay with cash if capable.
#1.1 excalpius on 25 Aug 2008 - 19:44
You can't. All hotels require the card to guarantee room charges etc.
#1.2 GOJI_GKing2000 on 25 Aug 2008 - 21:01
(excalpius said @ #1.1)
You can't. All hotels require the card to guarantee room charges etc.


I worked hotels and reservations, and yes you can. For many chains you have your room held until 5 pm as a courtesy of the hotel, after which late arrivals will only be guaranteed via CC. As far as room charges etc, its not that big of a deal to place cash on your account upfront at the hotel so you may make some purchases.

Its more work upfront if your willing to do it. Only down side is that for paying with cash you may be required pull out your Drivers License for copying the establishments record in the event the clerks screw up your account and allow you to overcharge/tear up the room etc.
#1.3 Airlink on 25 Aug 2008 - 21:45
All hotels accept Traveler's Cheques. They're like cash, only a bit more secure. You pay a premium to buy them, but they are backed by a big bank and/or credit card company and you have to countersign them before they can be cashed.

Banks and credit card companies don't like to tell people about Traveler's Cheques anymore because they make much more money keeping everyone in credit card debt.... but they still sell Traveler's Cheques.
(4 replies) #2 Long on 25 Aug 2008 - 14:29
Why do they store credit card numbers?
#2.1 GreyWolfSC on 25 Aug 2008 - 15:02
(Long said @ #2)
Why do they store credit card numbers?


Because they're idiots that want to get sued by their customers, I suppose...
#2.2 Webworldx on 25 Aug 2008 - 16:58
(GreyWolfSC said @ #2.1)
(Long said @ #2)
Why do they store credit card numbers?


Because they're idiots that want to get sued by their customers, I suppose...


All stores do.
#2.3 azcodemonkey on 25 Aug 2008 - 20:18
(Webworldx said @ #2.2)
(GreyWolfSC said @ #2.1)
(Long said @ #2)
Why do they store credit card numbers?


Because they're idiots that want to get sued by their customers, I suppose...


All stores do.

No they don't. Most stores would care little for maintaining that information. It's a liability. Most stores care about if your card is authorized, the amount approved, and the transaction captured by a 3rd party, and that's it.

I wonder why the card numbers weren't encrypted.
#2.4 Kupo-Cheer on 25 Aug 2008 - 20:54
They store credit card numbers supposedly for the convenience of the customer. Say you're making a reservation at a hotel or hotel chain that you've stayed at before already, then they can just ask "would you like to hold the room on this card?"

And no, you don't have a choice. You can pay with cash, sure, but most places will still require a credit card to ensure things like room damages and smoking in a non-smoking room cleaning fees that people would otherwise just skip out on. And actually, I can tell you that most of the time, it is the people that pay with cash that do that for a reason; because they are expecting to trash the room and do other things they know they shouldn't be doing.
(1 reply) #3 +Obi Wong on 25 Aug 2008 - 15:16
lol oh man
i always stay at Best Western when i go on vacation
how concerned should i be?
#3.1 CBTech on 25 Aug 2008 - 22:45
Very concerned. I have suspended their entire internet service for not securing their wireless network properly. Them, Holiday Inn and some others. No matter where you go, always be weary. There are "IT people" that are anything but that.
(2 replies) #4 +warwagon on 25 Aug 2008 - 15:37
After the hacker downloaded all the information, he should of the wiped the system clean, so the customers couldn't be contacted.,
#4.1 Andrey on 25 Aug 2008 - 19:00
(warwagon said @ #4)
After the hacker downloaded all the information, he should of the wiped the system clean, so the customers couldn't be contacted.,


Have your ever thought that it's better not to say anything rather than to say something stupid? Have you ever heard a word "backup"? Might want to do a research of what it means.
#4.2 Rohdekill on 26 Aug 2008 - 19:08
(Andrey said @ #4.1)
(warwagon said @ #4)
After the hacker downloaded all the information, he should of the wiped the system clean, so the customers couldn't be contacted.,


Have your ever thought that it's better not to say anything rather than to say something stupid? Have you ever heard a word "backup"? Might want to do a research of what it means.


You're under the assumption that people stupid enough to hold unencrypted credit cards on a system open to hackers are smart enough to have a backup plan in place?? That's a large assumption.

A better answer would have been: Erasing customer records after stealing the information would have raised alarm as ANYONE would have noticed the change. By leaving it as is, the only people who would find out is the moron(s) that setup the system for the hackers to get in.
(1 reply) #5 s3n4te on 25 Aug 2008 - 16:15
Are Canadian customers affected?
#5.1 tareqsiraj on 25 Aug 2008 - 17:14
(s3n4te said @ #5)
Are Canadian customers affected?

I think so ... "...credit card information of every customer who stayed with the international group since 2007".
(1 reply) #6 +Chrono951 on 25 Aug 2008 - 16:23
I like how the icon for the article is the "bad windows" icon. I don't see anywhere in the article where it mentions Windows as the culprit. Perhaps Neowin should use a more neutral icon for these types of articles?
#6.1 Rohdekill on 25 Aug 2008 - 17:25
(Chrono951 said @ #6)
I like how the icon for the article is the "bad windows" icon. I don't see anywhere in the article where it mentions Windows as the culprit. Perhaps Neowin should use a more neutral icon for these types of articles?


+1. I thought I was the only one who noticed the Neowin Anti-Windows logo being used when there is absolutely no mention of which operating system in use. I guess we know where Neowin stands.
#7 s3n4te on 25 Aug 2008 - 16:57
I think windows represent computers since most computers run on Windows, and the x stands for exploit or hacking.
#8 Don Matteo on 25 Aug 2008 - 17:00
How do they know he's Indian?
(2 replies) #9 waldenasta on 25 Aug 2008 - 17:43
nice...but I have to ask the same questoin Don Matteo asked "how'd they know the hacker was indian...?!!??" And why oh..why, would you store someone's information for so long?
#9.1 premedios on 25 Aug 2008 - 18:12
Well you're right there, waldenasta. Information that old should be transferred to an offline storage facility. True
#9.2 Laser_iCE on 25 Aug 2008 - 22:19
Because when he was cracking the security, they noticed his avatar was bouncing around from left to right every type he typed.
#10 Magallanes on 25 Aug 2008 - 18:22
The hacker "is" indian because they can track the registry and look who accesses (the IP) the database, with the IP is possible to determine the location of the hacker and, with the date/time is also possible to determine where was done the connection. Of course, only a fool will try to hack a system without hiding/spoofing their own ip, so yes, this "indian" can be any person, from other country or even a former/actual Best Western employee and usually the hack are from the inside.

#11 Mike Frett on 25 Aug 2008 - 20:20
I was issued a new card today, I guess because of that big breach weeks ago.
(1 reply) #12 imachip on 25 Aug 2008 - 20:29
Oh well, looks like I've got to phone the bank and request a new card :/ I doubt I'll stay at the Best Western chain again. I hope this ensures other companies tighten their security using securid's and proper anti-virus software to stop this happening.

Companies are responsible for the data they keep and thus should be sued when a security breach occurs. There is no reason to store data in a way that hundreds of thousands of records can easily be downloaded....
#12.1 imis on 25 Aug 2008 - 21:00
(imachip said @ #13)
Oh well, looks like I've got to phone the bank and request a new card :/ I doubt I'll stay at the Best Western chain again. I hope this ensures other companies tighten their security using securid's and proper anti-virus software to stop this happening.

Companies are responsible for the data they keep and thus should be sued when a security breach occurs. There is no reason to store data in a way that hundreds of thousands of records can easily be downloaded....

it is not best western chain or other company, it is only whom hacker want to go for.
companies should try to provide good security to their data.
war between evil and good will remain there.
(5 replies) #13 atari800 on 25 Aug 2008 - 23:36
Well if an Indian broke into Best Western, should we have some teenager break in the Best Mid-Eastern in response?
(Ba da boom -tiss)
#13.1 jonnytabpni on 26 Aug 2008 - 00:26
You idiot.

India is not in the middle east. It is in South Asia.

I am not having a dig at you however I hate the world's ignorrance when it comes to racial groups.

"Oooooh Indians...similar race to some terriosts....lets bomb them"
#13.2 atari800 on 26 Aug 2008 - 00:48
(jonnytabpni said @ #14.1)
You idiot.

India is not in the middle east. It is in South Asia.

I am not having a dig at you however I hate the world's ignorrance when it comes to racial groups.

"Oooooh Indians...similar race to some terriosts....lets bomb them"


Hey chickey pie
Ba Da Boom Tiss.... Does that sound like a "Rim shot"?
You must have been disgusted with Harold and Kumar movies
And who cares what you interpret from my comment.
So ....... get a hooka, a flute, a wicker basket full of snakes, wrap a bath towel around your head and calm down

Geeez some people are so stiff these days

Not having a dig at you but I dont even know if there is a Best Eastern...or a Best South Asia... it was a play on words
#13.3 Tantawi on 26 Aug 2008 - 00:56
(jonnytabpni said @ #14.1)
You idiot.

India is not in the middle east. It is in South Asia.

I am not having a dig at you however I hate the world's ignorrance when it comes to racial groups.

"Oooooh Indians...similar race to some terriosts....lets bomb them"


Lets bomb the "terrorists race"

You're aren't too bright either.
#13.4 jonnytabpni on 26 Aug 2008 - 20:55
(Tantawi said @ #13.3)
(jonnytabpni said @ #14.1)
You idiot.

India is not in the middle east. It is in South Asia.

I am not having a dig at you however I hate the world's ignorrance when it comes to racial groups.

"Oooooh Indians...similar race to some terriosts....lets bomb them"


Lets bomb the "terrorists race"

You're aren't too bright either.


What??
#13.5 jonnytabpni on 26 Aug 2008 - 20:59
(atari800 said @ #13.2)
(jonnytabpni said @ #14.1)
You idiot.

India is not in the middle east. It is in South Asia.

I am not having a dig at you however I hate the world's ignorrance when it comes to racial groups.

"Oooooh Indians...similar race to some terriosts....lets bomb them"


Hey chickey pie
Ba Da Boom Tiss.... Does that sound like a "Rim shot"?
You must have been disgusted with Harold and Kumar movies
And who cares what you interpret from my comment.
So ....... get a hooka, a flute, a wicker basket full of snakes, wrap a bath towel around your head and calm down

Geeez some people are so stiff these days

Not having a dig at you but I dont even know if there is a Best Eastern...or a Best South Asia... it was a play on words


OMG your just proving my point even more. For a start, Indians tend not to wear towels around their head. But anyway, I don't really care what you think. Thank Goodness that there are many people in the world who are bigger than you who just know not to say such offensive stupid thing.

I *could* bring up the stupid amercian thing (assuming that you are amercian - hey you made some wrong assumptions too) but I won't coz I have faith in the human race and that not everyone's personality can be sterotyped by their racial group.

Tip to the world: Stop judging each other by the colours of ones skin. Not all Amercian are stupid. Not all brown coloured folks are related to or from the same country as each other. I hate this world of ignorrance. Let's try and do something to stop it
(1 reply) #14 on 01 Jan 1970 - 00:00
#14.1 jonnytabpni on 26 Aug 2008 - 00:29
Don't be so racist!

The fact he was Inidan has nothing to do with it! You can get other nationalities capable of the same thing!

You post your stupid comments here coz YOU think your so big by slagging off other racial groups!

Get a life!

Oh...and what hostility is there between India and the western world? NONE! Get your facts right and stop being so ignorrant!
#15 em_te on 26 Aug 2008 - 00:54
The "root cause" is them storing the credit card numbers.
#16 Creative Cha0s on 26 Aug 2008 - 03:13
I agree information should only be stored for as long as the pay-date, then disposed of immediately.
(1 reply) #17 premedios on 26 Aug 2008 - 13:58
I apologize for the racist comment
#17.1 jonnytabpni on 26 Aug 2008 - 21:08
Forgiven

We just all have to realise that the colour of ones skin cannot determine their political beliefs, religion or even the country that they are from.

Yes, Indian folks do have a similar race to some middle eastern countries that the USA is at wars with, however there is no hostility between Indian and the western world.

My mother and father are Indian. However my mother lived all her life in the UK and I was born here and I have never even visited India. I have actually lived longer in the Western World than some people that say racists things to me. I feel as British/Irish (living in Northern Ireland here lol) as any other person in this province.
#18 jonnytabpni on 26 Aug 2008 - 21:10
I really don't understand why that would want to store this information. Maybe it's just done.

I work in a shop that keeps all the credit card slips which have to numbers on them. Imagine if they got stolen....
#19 enaran on 27 Aug 2008 - 08:30
Surely Best Western would be in breach of the PCI DSS - Payment Card Industry Data Security Standard.

Working for a software development company who designs Hotel Reservertion Management Software in the Hotel Industry I am very much aware of the requirements of this standard that specifically state how credit card numebrs can be stored and for how long.
I belive that there are massive fines for clear breaches of the standard - not to mention the potential to loose their merchant facilities.

PCI DSS on Wikipedia
#20 Atlonite on 28 Aug 2008 - 07:16
And see thats why i wont have a credit card if you cant pay cash or chq (personal or travelers) go somewhere else. the other thing is why do they need to hold my details for so damn long if after a month there's no discrencies then delete it please. i dont see why that cannot happen and it would be much more secure than the previous situation instead of millions they'd only get if at all a few thousand and the offending company get investigated to see why it was able to be hacked and charged if it was found to be negligent in its security of personal data

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)