The seller is requesting 8 Bitcoin for the trove of data, claiming it had been obtained from Huazhu Hotels Group Ltd, which is one of China’s largest and most extensive hotel chains.

With 13 different hotel brands spanning over 5000 hotels across more than 1000 cities throughout China, Huazhu have massive amounts of data on file.

Multiple cyber-security firms spotted the advertisement on the online forum and raised alerts immediately, and was further reported extensively by Chinese media. Huazhu themselves are currently conducting internal investigations.

The data being held captive

According to the ad description posted by the hacker, the data for sale is 141.5GB in size and contains 240 million records, with personal details about approximately 130 million hotel guests.

These details are believed to include the following:

• Official website registration information (ID card number, mobile phone, email address, password)
• Check-in registration information (ID card number, name, address, birthday)
• Booking information (ID card number, name, mobile phone, check-in and departure times, hotel ID number, room number)

The individuals which this data correlates to are customers who previously stayed at any of Huazhu’s hotel chains.

Tracing the breach

Zibao, a Chinese cyber security firm, reported to a local news outlet that they’ve managed to verify the authenticity of the data, and that the breach itself likely took place earlier in August.

Their current theory is that the breach resulted because of a mistake from a member of Huazhu’s software development team. One of the programmers seemed to have accidentally uploaded copies of their entire database onto a Github account, which must’ve been picked up and replicated by the hacker.

And now it’s all for sale.

The post Personal Data of 130 Million Chinese Individuals Selling for 8 BTC on the Dark Web appeared first on Hack Ware News.