The BYOD ransomware group may only have five alleged victims listed on its darknet leak site, but the group may well be on the verge of a truly global breach if it can back up its most recent hack claims.The group – which only emerged in September – has said its latest victim is global hotel giant IHG Hotels & Resorts, which operates locations around the world, including 69 hotels in Australia.
You’re out of free articles for this month
The group taunted IHG over its allegedly poor password security before delving into the details of the data they claim to be holding.
“Nice LDAP Binding Password being (REDACTED – Ed). Rotating things won’t really save you casue [sic] it’s not hard to hop back on your network,” the hackers said in a 3 November leak post.
“Anyways, we now have: Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store.”
BYOD also claimed to have compromised reservation ledgers and financial records linked to IHG’s hotels.
“This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc,” it said.
The hackers have not published any evidence to back up their claims.
Cyber Daily has reached out to IHG Hotels & Resorts’ head office as well as their local representatives.
Who is BYOD?
Because of its relative newcomer status, it is difficult to judge the strength of BYOD’s claims.
However, the group so far appears to be legitimate, though questions remain regarding possible links to another new ransomware actor, Endzone. That latter operator claimed prior breaches of two of BYOD’s victims – Trump Mobile wireless and recruitment firm eTeam.
While the eTeam breach remains firmly in the ‘alleged’ category for now, the Trump Mobile claim does appear to be legitimate. Names mentioned in the leak appear to be linked to real customers, as reported by PC Mag.
“Three people in the leaked file confirmed to PCMag that they had interacted with Trump Mobile in the past. We were able to reach out to them because the leaked file contained their name, phone number, email address, and physical address,” the technology outlet said.
“One customer was also surprised that the leaked file accurately showed they had cancelled their Trump Mobile service for the ‘30 Day Unlimited Talk Text Data’ plan.”
The Trump Mobile incident has also been noted by at least one US politician.
“Concerningly, the ransomware group that announced accessing customer details in October claimed that when it notified Trump Mobile of the breach, the company responded that ‘[w]e have no team to handle this,’” wrote Senator Maggie Hassan in a letter to Trump Mobile CEO Patrick O’Brien.
Michigan State University, another victim claimed by BYOD, is also taking the hackers’ claims seriously, though it has not yet verified those claims.
“Michigan State University is actively monitoring and investigating a potential cybersecurity threat. MSU IT, our cyber security partners, law enforcement and the State of Michigan are working together to take the appropriate steps to protect the university, its information, and the continued delivery of campus services,” the university said on 3 November.
“The investigation is ongoing, and MSU has not determined that any personal information was compromised.”
BYOD also claimed responsibility for a cyber attack that disrupted operations at the University of New Mexico Health Sciences Center. Ambulances were forced to divert, classes were cancelled, and patient admissions were compromised. The hackers, however, later removed the data and apologised for targeting a healthcare provider.
“We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only,” BYOD said.
“To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That’s the whole reason why we came about and we plan to keep it that way.”
BYOD has since removed the data from its leak site.
Who is IHG Hotels & Resorts?
If BYOD’s claims of “complete” compromise of IHG Hotels & Resorts employee data are accurate, the fallout could impact its more than 380,000 individuals across more than 6,800 leases and franchises globally, including 69 in Australia.
Its Australian properties include Holiday Inn Melbourne Bourke Street Mall, Crowne Plaza Sydney Darling Harbour, and InterContinental Sanctuary Cove Resort.
The group is headquartered in England.
——————————————————–
Click Here For The Original Source.
