Frequent flyer miles are usually earned from a Frequent Flyer Program (FFP), a loyalty scheme offered by airlines. The points are accrued by travelling with the airline, the more you travel, and the greater the distance, the more points you accumulate.

This is normally how it works, but different airlines may off alternative ways to earn points, such as shopping at certain outlets or staying in certain partnership hotels. These points can then be exchanged for air fare, seating class upgrades or access to luxury airport lounges.

Researchers at a company called CompariTech have trawled the Dark Web and come up with some interesting finds. You can buy air miles for Delta flights or British Airways, that have been hacked from compromised accounts. $124 will get you 100,000 British Airways air miles, $884 will get you 100,000 air miles with Emirates Skywards, or the same price you can get 45,000 Delta sky miles. This makes buying air miles illegally considerably cheaper than earning them.

The process of obtaining the miles usually works like this; a hacker will hack in to an air miles account and transfer the air miles into a different account, “gifting” them to the secondary account. They can then either sell this account or transfer the air miles from this account to an account of your choosing. The air miles are sold in two categories, either “clean” or “tainted”.

Clean meaning that you will likely have no trouble using them because there’s no evidence the original account holder knows they have been hacked, assumedly because people aren’t keeping track of their air miles like they are their bank account. Tainted accounts allow you to purchase air miles for much cheaper, but there’s a risk you won’t be able to use them since they may have been blocked.

The post Are your frequent flyer miles safe from Dark Web hackers? appeared first on Hack Ware News.

The seller is requesting 8 Bitcoin for the trove of data, claiming it had been obtained from Huazhu Hotels Group Ltd, which is one of China’s largest and most extensive hotel chains.

With 13 different hotel brands spanning over 5000 hotels across more than 1000 cities throughout China, Huazhu have massive amounts of data on file.

Multiple cyber-security firms spotted the advertisement on the online forum and raised alerts immediately, and was further reported extensively by Chinese media. Huazhu themselves are currently conducting internal investigations.

The data being held captive

According to the ad description posted by the hacker, the data for sale is 141.5GB in size and contains 240 million records, with personal details about approximately 130 million hotel guests.

These details are believed to include the following:

• Official website registration information (ID card number, mobile phone, email address, password)
• Check-in registration information (ID card number, name, address, birthday)
• Booking information (ID card number, name, mobile phone, check-in and departure times, hotel ID number, room number)

The individuals which this data correlates to are customers who previously stayed at any of Huazhu’s hotel chains.

Tracing the breach

Zibao, a Chinese cyber security firm, reported to a local news outlet that they’ve managed to verify the authenticity of the data, and that the breach itself likely took place earlier in August.

Their current theory is that the breach resulted because of a mistake from a member of Huazhu’s software development team. One of the programmers seemed to have accidentally uploaded copies of their entire database onto a Github account, which must’ve been picked up and replicated by the hacker.

And now it’s all for sale.

The post Personal Data of 130 Million Chinese Individuals Selling for 8 BTC on the Dark Web appeared first on Hack Ware News.