Booking.com Breach Fuels Sophisticated Hotel Impersonation Scams

Executive Summary

A significant data breach at Booking.com is actively fueling a wave of sophisticated hotel impersonation scams. According to analysis by Malwarebytes, threat actors have obtained detailed guest reservation records, which they are using to craft highly targeted phishing messages. These messages, appearing to come from a victim's booked hotel, leverage accurate trip details to trick guests into providing payment card information and account credentials. The breach appears to be ongoing, with data likely exfiltrated via compromised hotel accounts on the Booking.com platform.

Technical Analysis

The attack chain exploits the trusted relationship between a hotel, a booking platform, and the guest. Malwarebytes researchers report that the breach is not a direct compromise of Booking.com's core reservation systems, but rather the result of credential theft from hotels using the platform. Threat actors gain access to a hotel's Booking.com extranet account—the backend portal where hotel staff manage reservations. From there, they can view, and likely export, the full details of upcoming and recent guest bookings.

The stolen data is comprehensive, typically including the guest's full name, reservation ID, check-in/check-out dates, hotel name, contact details, and any communication history between the guest and the hotel. This information provides everything needed for a convincing spear-phishing attack. The attackers then contact the guest, often via email or messaging platforms like WhatsApp, posing as the hotel. They use the legitimate reservation details to establish credibility before presenting a urgent request, such as a problem with the payment that requires immediate re-submission of card details via a malicious link.

Tactics, Techniques & Procedures

Threat actors are employing a multi-stage TTP set blending cyber and social engineering techniques:

• Initial Access: Likely via phishing or credential stuffing to compromise hotel staff accounts on the Booking.com extranet (T1589.001 - Gather Victim Identity Information: Credentials).
• Collection: Data exfiltration from the reservation management system (T1530 - Data from Cloud Storage).
• Phishing for Details: Crafting targeted communications (Spearphishing via Service, T1566.003) using authentic reservation data to build trust.
• Financial Fraud: Redirecting victims to phishing pages designed to harvest payment card data (T1589.002 - Gather Victim Payment Information) or login credentials.

Threat Actor Context

The specific threat actor or group behind the credential theft and data harvesting is not identified by Malwarebytes. However, the end goal—financial fraud via payment card harvesting—aligns with common cybercriminal operations. The tactics suggest a degree of specialization in targeting the hospitality supply chain, recognizing the high value of time-sensitive, trusted reservation data. It is unclear if this is a single organized group or a service sold to multiple fraudsters on underground forums.

Mitigations & Recommendations

Guests who have used Booking.com should be highly skeptical of any communication purporting to be from their hotel, especially those requesting payment or login details. Key recommendations include:

• Verify Directly: Contact the hotel using a phone number obtained from their official website, not from any message received.
• Avoid Clicking Links: Do not click on links or download attachments in messages about reservations. Log in directly to the official Booking.com app or website to check your reservation status.
• Use Secure Payment Methods: Be wary of requests to provide card details via email, text, or third-party forms. Legitimate businesses typically process payments through their secure portals.
• For Hotel Partners: Implement strong, unique passwords for Booking.com extranet accounts and enable multi-factor authentication (MFA) if available. Train staff to recognize phishing attempts targeting their business credentials.
• Monitor Accounts: Guests should monitor their payment card statements for unauthorized transactions following any suspected scam attempt.