Data leak of 130 million Chinese hotel clients available on dark web for 8 bitcoin

The leaked information potentially includes 240 million lines of data containing phone numbers, email addresses, bank accounts and booking details, and is available on the dark web.

Shanghai police are investigating one of the largest data leaks on the mainland that could affect about 130 million clients of Huazhu Hotels Group.

Huazhu, which owns more than 10 hotel brands and manages more than 3,800 hotels across 382 mainland cities, reported the data breach after finding a post on a dark web forum about the sale of its clients’ personal data and booking information.

According to local media, the leaked information potentially includes 240 million lines of data containing phone numbers, email addresses, bank accounts and booking details, and is available on the dark web for 8 bitcoin or about US$56,000 (RM231,089).

“Those who commit illegal acts including theft, trading and exchange of residents’ personal data will be heavily punished,” the Shanghai police said in a statement. “We are resolute in protecting people’s interest and ensuring information security.”

A Huazhu official said that progress has been made in the investigations, but she did not reveal further details.

The dark web is a small part of the deep web that is not indexed by web search engines, where sites sell drugs, counterfeit money and much more.

The media reports said the data could have been hacked in early August when Huazhu programmers uploaded information to GitHub, a service that allows engineers to collaborate on developing software coding.

Yin Ran, a Shanghai-based angel investor in the information technology sector, said data breaches were becoming regular feature and that it poses a serious threat to China’s digitalisation drive. “Strangers would approach us for trading of personal data owned by our portfolio firms,” Yin said. “The potential risks are huge and such illegal behaviour must be eradicated to pave the way for further development of digitalised businesses.”

Beijing however has stepped up a crackdown on the illicit data market amid an increasing number of incidents involving data leakage.

In April, Chinese artist Deng Yufeng bought personal data of 346,000 Wuhan residents on the black market and exhibited them in an art gallery, which was promptly shut down by the authorities.

In May, Huazhu became a shareholder of AccorHotels, after taking a 4.5% stake in the largest hospitality group in Europe.

The two companies formed a partnership in 2014 when they joined the hands to bolster expansion of AccorHotels’ brands such as Mercure, Sofitel and Ibis on the mainland, the world’s largest travel market. – South China Morning Post