In the dark web, a hacker is selling personal data of over 240 million records belonging to 130 million individuals for 8 BTC on a Chinese dark web forum.
The data belongs to guests that stayed at one of the hotels managed by Huazhu Hotels Group Ltd, one of China’s largest hospitality chains.
Established in 2005, Huazhu operates more than 3,000 hotels, which includes Grand Mercure, Manxin, Novotel, Mercure, CitiGo, Orange, AllSeason, Starway, Ibis, Elan, Haiyou and others across 382 cities in China.
User data believed to be sold online, include: official website registration information (ID card number, mobile phone number, email address, login password); check-in registration information (customer name, ID card number, home address, birthday), and booking information (name, card number, mobile phone number, check-in time, departure time, hotel ID number, room number, spending amount).
The total data is roughly 141.5 GB in size.
"Those who commit illegal acts including theft, trading and exchange of residents’ personal data will be heavily punished," said the Shanghai police in a statement. "We are resolute in protecting people’s interest and ensuring information security."
Hotels have long been a favorite target of data thieves. This is because guests of hotels would be using a payment card and ID, point of sale and reservations systems. These information are regarded as personal, and present a trove for fraudsters.
According to Chinese Cybersecurity firm Zibao, the data is authentic, and data cross-validation results August 13 as the most recent departure time.
China has been clamping down cryptocurrency usage in the country, even indirectly, forced BAT (Baidu, Alibaba and Tencent) to ban all cryptocurrency-related transactions and discussion forums on their respective platforms. The government has also banned the websites of more than 124 offshore cryptocurrency exchange desks.
But inside the dark web where people are anonymous browsing their ways through hidden networks, China has no control. The dark web is not regulated and mostly out of reach of the authorities. And cryptocurrencies are the primary method of payments.
It was speculated that the data was likely leaked when the development teams at Huazhu accidentally uploaded copies of their company's database to GitHub.
This incident tumbled the shares of New York-listed Huazhu, also known as China Lodging Group, by 4.4 percent to $33.98.
