The breached customers’ data of Huazhu Group company is now being offered for sale on Dark Web for 8 bitcoin
IT is going to happen, and it is happening as this piece was being written, and will continue to happen as cyber bad guys seem to always be a step ahead of organizations’ cyber-security sentinels.
What is being referred here is “hacking,” the breaching by cyber attackers of security protocols of organizations and stealing data, either for sale or for political purposes, or for blackmail, or for vengeance. Or it could be just for the fun of it.
And this time it is the Huazhu Group, a China-based organization that operates more than 3,000 hotels in more than 100 cities across the world.
Among the brands that it carries include Mercure and Ibis, Hanting and Crystal Orange.
So, what happened?
McGallen and Boulder quoted mainstream news reports that around “500 million pieces of information of the hotel group’s customers (personal data, booking records, financial information, etc.) may be breached, and data of 130 million guests’ information are found on the Dark Web available for 8 bitcoin (around US$56,000).”
ALSO READ: The quest for an unhackable code
For Tim Mackey, technical evangelist of Synopsys, the customers’ data breach to the Chinese hotel group revolves around making money.
“This looks like an opportunistic ‘hack’ in a vein quite similar to that of the Uber ‘hack’ last fall. Development teams using public source code system like GiHub and public continuous integration (CI) systems like Travis-CI need to recognize that any developer activity which causes a push to a public repository or a public branch can be viewed by others,” said Mackey.
ALSO READ:DICT sets 5th startup competition; Huawei to send winner to China
The Synopsys executive suggested that in order to fight off the potential leaking out of credentials, configuration information and data, “these teams need to have strong policies surrounding how debugging of CI occurs, where forks of code by core developers are located, and the conditions under which a push to a public branch for CI occurs.”
As hosted development tools like GitHub, Jira and Travis-CI becoming increasingly popular, said Mackey, they also render them ideal sources of information for malicious actors.
ALSO READ: Microsoft online services hit by major failure
The Synopsis technical evangelist called out organizations to strengthen their security.
“Consumers of hosted tools should ensure the security requirements their organization places on code being developed can be met by these tools and that they’re correctly configured to meet those requirements. Put in another way, while it is possible to ‘outsource’ the management of developer tooling, it is very likely the default configuration is not appropriate to your requirements and you should invest in ensuring your security requirements are met,” he added. (EKU)
ALSO READ:Ant Financial launched Blockchain-based money remittance for Filipinos
 may be breached, and are found on the Dark Web for sale for 8 bitcoin (around US$56,000).”){kind=link}