Marriott, Hilton hotels exposed in Otelier data breach

Edited by: Top Class Actions | January 27, 2025

Category: Data Breach

A hotel receptionist on the phone while using a computer, representing the hotel hack. — (Photo Credit: Drazen Zigic/Shutterstock)

Otelier data breach overview:

Who: Hotel management platform Otelier reportedly experienced a data breach.
Why: The breach reportedly exposed hotel guest reservations and other sensitive data for several high-profile hotel chains, including Marriott and Hilton.
Where: The hotel hack affected hotel chains across the U.S. and around the world.

A data breach at hotel management platform Otelier has reportedly exposed sensitive customer data from high-profile hotel chains, including Marriott and Hilton.

The bad actors behind the data breach told BleepingComputer they were able to breach Otelier by using infostealer software to snag Atlassian login credentials from an Otelier employee, reports TechRadar.

Otelier is a hotel management platform reportedly used by more than 10,000 hotels around the globe, including both independent properties and leading brands such as Hyatt, Wyndham and others.

The hackers, meanwhile, told BleepingComputer they were able to scrape tickets and data in Otelier’s system during the hotel hack that allowed them to obtain credentials for an Amazon Web Services (AWS) data storage container known as an S3 bucket, reports TechRadar.

Marriott reportedly said the bad actors initially tried to extort the popular hotel chain, believing it owned the stolen data.

Hackers claim to have exfiltrated 7.8TB of data during Otelier data breach

The bad actors reportedly said they were able to exfiltrate 7.8TB of data — including “millions of documents belonging to Marriott” — during the hotel hack, after obtaining the credentials for the AWS S3 bucket

Information exposed in the data breach included hotel reports, shift audits and accounting data, among other things, reports TechRadar.

A sample of the stolen data reportedly apparently included hotel guest reservations, employee emails, transaction information and other internal data.

Otelier said hundreds of thousands of email addresses were exposed in the data breach in total; in some cases, the bad actors obtained hotel guests’ names, addresses, phone numbers and email addresses, reports TechRadar.

Otelier reportedly told BleepingComputer it hired a team of cybersecurity experts to analyze and validate its systems in the wake of the hotel hack, and that a subsequent investigation found the unauthorized access “was terminated.”

In other data breach news, the Country Inn & Suites Radisson hotel chain reportedly suffered an alleged data breach last year that may have exposed the personal information of thousands of Radisson customers.

Are you affected by the Otelier data breach? Let us know in the comments.