Otelier data breach: 436K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2025-01-18
In July 2024, a threat actor gained access to the hotel management platform Otelier and retrieved customer data from well-known hotel brands including Marriott, Hilton, and Hyatt. The data included 437k customer email addresses (a further 868k generated email addresses from the booking.com and Expedia platforms were not loaded into HIBP), names, physical addresses, phone numbers, booking information related to travel plans, purchases recorded by the platform and in a small number of cases, partial credit card data. Exposed data: email addresses, names, partial credit card data, phone numbers, physical addresses, purchases, travel plans. The breach dates from Jul 1, 2024; Have I Been Pwned loaded it on Jan 18, 2025.
What to do
- If you had a Otelier account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
