Booking.com Fined €475,000 For Late Data Breach Reporting

ByPR 24

The Dutch Data Protection Authority (AP) has imposed a €475,000 fine on Booking.com for reporting a data breach to the AP too late. Cybercriminals exfiltrated the personal data of more than 4,000 customers and they were also able to obtain the credit card details of nearly 300 victims.

Source

Hackers extracted login credentials of victims’ accounts in a Booking.com system from employees of 40 hotels in the United Arab Emirates by telephone.

In December 2018, attackers gained access to the data of 4,109 people who had booked a hotel room in UAE via Booking.com. This included their names, addresses and telephone numbers and details about their booking.

The criminals also stole the credit card details of 283 people, including the security code of the credit card in 97 cases. In addition, they tried to obtain the credit card details of other victims by posing as an employee of Booking.com by email or telephone.

Booking.com customers ran the risk of being robbed here. Even if the criminals did not steal credit card details, but only someone’s name, contact details, and information about his or her hotel booking. The scammers used that data for phishing. By pretending to be a hotel representative by phone or email, they tried to take money from people. This can be very credible if a scammer knows exactly when you have booked which room. And asks if you want to pay for those nights. The damage can then be considerable.AP Vice President Monique Verdier

Booking.com was notified of the data breach on January 13th, 2019, but did not report it to the AP until February 7th. That is 22 days late. The GDPR mandates that companies must report data breaches within 72 hours.

Booking.com notified affected customers of the leak on February 4th, 2019. In addition, the company took other measures to limit the damage, such as the offer to compensate for any financial losses.

This is not the first time Booking.com is dealing with such an attack. In November 2020, the company was hit with another hack with millions of its customers’ data potentially exposed.

Verdier argued that this was a serious violation of the trust that millions of customers place in the platform to keep their details safe. Online firms’ obligations don’t just extend to best practice cybersecurity controls, she claimed, but also to reacting quickly if and when things do go wrong.

A data breach can, unfortunately, happen anywhere, even if you have taken good precautions. But to prevent damage to your customers and the recurrence of such a data breach, you have to report this in time.AP Vice President Monique Verdier

According to AP, Booking.com will not contest the fine.

Similar Posts

Hackers Set Up a Fake Cybersecurity Firm to Target Security Experts

Hackers Set Up a Fake Cybersecurity Firm to Target Security Experts

ByPR 24

A North Korean government-backed campaign targeting cybersecurity researchers with malware has re-emerged with new tactics in their arsenal as part of a fresh social engineering attack. In an update shared on Wednesday, Google’s Threat Analysis Group said the attackers behind the operation set up a fake security company called SecuriElite and a slew of social…

Iran names suspect in Natanz attack, says he fled country

Iran names suspect in Natanz attack, says he fled country

ByPR 24

State television named the suspect as 43-year-old Reza Karimi. It showed a passport-style photograph of a man it identified as Karimi, saying he was born in the nearby city of Kashan, Iran. The report also aired what appeared to be an Interpol “red notice” seeking his arrest. The arrest notice was not immediately accessible on…

Microsoft Exchange: Server Attack Attempts Skyrocket

Microsoft Exchange: Server Attack Attempts Skyrocket

ByPR 24

Cybercrime , Fraud Management & Cybercrime , Fraud Risk Management Check Point Research Tracks Tenfold Increase in 5 Days Doug Olenick (DougOlenick) • March 16, 2021     From Thursday through Monday, Check Point Research tracked a tenfold increase in the number of attempts to exploit vulnerable on-premises Microsoft Exchange servers as many organizations are…

Five Months After Takedown Attempt, CISA and FBI Warn of Ongoing TrickBot Attacks

Five Months After Takedown Attempt, CISA and FBI Warn of Ongoing TrickBot Attacks

ByPR 24

Attacks employing the TrickBot malware continue, leveraging phishing emails as the initial infection vector, the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) warn. In a joint advisory published on Wednesday, the two agencies revealed that a sophisticated group of cybercrime actors is leveraging a traffic infringement phishing scheme to lure…

NY Department of Financial Services Issues Cyber Fraud Alert to Auto Insurers – HOTforSecurity

NY Department of Financial Services Issues Cyber Fraud Alert to Auto Insurers – HOTforSecurity

ByPR 24

The New York Department of Financial Services (NYDFS) has issued an alert to instant-quote websites, particularly car insurers, warning of a growing campaign to steal nonpublic information (NPI). The agency says it learned of the threat after receiving reports from auto insurers that cybercriminals were targeting their premium quote sites to steal driver’s license numbers….

Two members of QQAAZZ, which laundered funds from cybercrime, plead guilty

Two members of QQAAZZ, which laundered funds from cybercrime, plead guilty

ByPR 24

Written by Tonya Riley Aug 9, 2021 | CYBERSCOOP Two individuals involved with laundering funds from U.S. victims of cybercrime pleaded guilty to their role in a transnational organization that relied in part on hacking to defraud victims out of millions of dollars, the Justice Department announced Friday. The defendants, Arturs Zaharevics and Aleksejs Trofimovics,…