Ik kreeg vandaag een mail van booking:
Hello,
At Booking.com, we are dedicated to the security and data protection of our guests. In that spirit, we’re writing to inform you that unauthorized third parties may have been able to access certain booking information associated with your reservation.
We recently noticed suspicious activity affecting a number of reservations and we immediately took action to contain the issue. Based on the findings of our investigation to date, accessed information could include booking details and name(s), emails, addresses, phone numbers associated with the booking and anything that you may have shared with the accommodation.
To keep your booking secure, we have updated the PIN number of your booking reservation.
.......
We recommend that you have security protocols (such as an antivirus programme) set up on your devices to keep you safe from phishing attempts.
The security of your personal information is our utmost priority. We will continue to enhance and extend the robust security measures we have in place to secure your reservations with us.
We’re here to support you, so if you have any questions or concerns or notice any unexpected changes to your reservation, please do not hesitate to contact our Customer Service team, available 24/7. You can find the contact information in your reservation confirmation.
Mijn eerste idee was dat het om phishing ging want klanten aanspreken met "hello" i.p.v. een naam doet al alarmbellen af gaan.
Ze stuurden wel naar het juiste e-mailadres en er stond geen link in de mail om in te loggen.
Na zelf in te loggen op booking kon ik het reservatienummer wel terugvinden en de pincode was idd veranderd.
Het gaat om een reservatie die we in januari deden, andere reservaties die we later deden werden niet vermeld. Dit doet mij vermoeden dat de hacking ergens in het begin van het jaar gebeurde en al een hele tijd opgelost is maar om 1 of andere reden veel later openbaar gemaakt werd (tenzij er nog mails volgen).
Nu heb ik ondertussen ook al twee mails gekregen van een ander boekingsplatform (myguestdiary.com) waar ook een "breach" geweest is en ook zij waarschuwen voor phishing.
GuestDiary Security Alert
Dear guest,
We wish to advise that we are aware of the possibility of phishing emails
and phishing WhatsApp messages being sent with respect to hotel
reservations you have with *********.
This is to inform you to please remain vigilant about this possibility and
to contact *********** for clarification if you receive any
additional requests for payment or any unusual requests regarding your
reservation.
............
What Happened
************** uses a trusted thirdparty service provider called
GuestDiary to manage reservations, checkins, and communications relating
to your stay. The service provider experienced a security incident
involving unauthorized access by an external party to an area within its
system where certain personal data and reservation information is held.
Please be advised that the incident was limited to the GuestDiary system
only, and there is no evidence to suggest that any other systems or
service used by ****************** have been impacted.
What Personal Data May Be Affected
The information that may have been accessed includes:
- Your name
- Your email address
- Your phone number
- Your reservation details with *********************, including arrival and
departure dates
No payment card details or financial information were affected.
What This Means for You
As the incident involved unauthorised access by unknown third parties,
there is a risk that someone may attempt to contact you while
impersonating *******************, in an effort to obtain personal or
payment information from you. This is a form of online fraud known
as phishing, where attackers try to trick individuals into sharing
sensitive details.
For example, you may receive a message requesting payment or asking you to
update your payment details by email, SMS or WhatsApp.
What You Should Do
- If you receive any unexpected communication about your reservation,
please contact the hotel directly using official contact details. - If
you believe you may have shared payment information in response to a
suspicious message, please contact your bank or card provider
immediately.
What You Should Not Do
- Do not share payment card details, passwords, or identification
documents in response to unsolicited messages. - Do not click on links
or download attachments from unexpected or suspicious communications
What We Are Doing
As service provider of the GuestDiary software system, the GuestDiary
security teams is actively monitoring the situation and updating
hotels/properties where we see any evidence of potential phishing.
If you have any questions about this communication, please contact your
hotel directly. You may also contact GuestDiary's service provider
incident response team at *******@guestdiary.com with any queries you may
have.
Ook daar "dear guest"...
.
