Monday, February 10, 2025
HomeComputer SecurityHackers Selling More than 200 Million Stolen Data from Chinese Hotel Chain...

Hackers Selling More than 200 Million Stolen Data from Chinese Hotel Chain in Dark Web

Published on

SIEM as a Service

Follow Us on Google News

Hackers advertising and selling more than 200 million highly sensitive data in a Dark web forum that was stolen from the China-based hotel chain.

Initially, researchers believe that the stolen information is only personally identifiable information (PII) of Chinese customer but further analysis helps then to uncovered that the stolen information from other Asian countries as well.

These stolen data belong to one the data breach that reported in last August 29 that exposed up to 130 million PII from Huazhu Hotels Group.

A Dark web forum that advertises these stolen data for the cost of eight bitcoins that is roughly around  US$58,000.

Advertising Data Amount from Hacked Database Data

Hackers claiming that the First set of stolen data contains various sensitive information including names, mobile phone numbers, email addresses, ID numbers, and residential addresses, among others from 53GB data contain 123 million records.

The second set of data contain 130 million customer ID information such as registered check-in time, customer name, ID number, home address, birthday, and internal ID number from 22.3 GB data.

Third dark web advertisement refers around 240 million records from 66.2GB data which including customer names, room numbers, card numbers, mobile numbers, email addresses, check-in and departure times, and hotel ID numbers.

Apart from this, Buyers and members of the dark web forum specifically request the particular set of data, for example, one of the forum members asked only a female data.

Selling Stolen Data and Compromised Victims are not limited

According to Trend Micro research, The data from the hotel chain is only a portion of what’s being sold in the deep web forum. The following is an example of other stolen data and illicit products we found being sold in the forum:

  1. Student-, hotel-, and financial investment-related PII. This PII included full names, Alipay accounts, WeChat bills, debit card, and other finance-related data.
  2. Banking and ID card information; interestingly, this is sold in the form of pictures of people holding the IDs, likely done as proof of identification.
  3. PII of contestants of a national pageant. The PII included names, physical attributes, and social media accounts.
  4. Stolen Taiwanese and Brazilian credit card data (payment can be sent to the user’s Steam account).
  5. PII of residents in Beijing.
  6. China national passports and other documents.
  7. Personal pictures of young female users in QQ accounts.

Our various research efforts showed that stolen and leaked PII is a staple offering in many cybercriminal underground marketplaces, which makes data privacy and security a must for organizations, Trend Micro said.

Also Read:

Tor Browser for Android – Browse Anonymously on Android Devices

Mobile Spyware Maker mSpy Leaked Millions of Sensitive Data Online in Plain Text

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

New Report of of 1M+ Malware Samples Show Application Layer Abused for Stealthy C2

A recent analysis of over one million malware samples by Picus Security has revealed...

Seven-Year-Old Linux Kernel Bug Opens Door to Remote Code Execution

Researchers have uncovered a critical vulnerability in the Linux kernel, dating back seven years,...

Ransomware Payments Plunge 35% as More Victims Refuse to Pay

In a significant shift within the ransomware landscape, global ransom payments plummeted by 35%...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

INDOHAXSEC Hacker Group Allegedly Breaches Malaysia’s National Tuberculosis Registry

The Indonesian hacker group "INDOHAXSEC" has allegedly breached the National Tuberculosis Registry (NTBR) of...

Massive Hacking Forum Network Dismantled by Authorities, Impacting 10M Users

Authorities have delivered a major blow to the cybercrime world by dismantling two of...

Is this Website Safe: How to Check Website Safety – 2025

is this website safe? In this digital world, Check a website is safe is...