.svg){kind=logo}
Hotel management platform Otelier experienced a significant data breach after cybercriminals accessed its Amazon S3 cloud storage. The breach compromised millions of guests’ personal information and reservations for well-known hotel brands such as Marriott, Hilton, and Hyatt.
Details of the Otelier Breach
The breach allegedly began in July 2024 and continued through October. The attackers claim to have stolen approximately 7.8 terabytes of data from Otelier’s Amazon AWS S3 buckets. The hackers initially gained access to Otelier’s Atlassian systems through information-stealing malware. Once they gained access to Atlassian, they used this information to scrape additional data about Otelier, which led to the discovery of the company's S3 bucket credentials.
Data Involved
The exposed data encompasses a wide range of information. Thankfully, passwords and billing information do not seem to have been compromised. The attackers accessed hotel guest reservations, transactions, employee emails, and other internal data. Personal information such as guests’ names, addresses, phone numbers, and email addresses was also compromised. Check Have I Been Pwned to see if your information was leaked.
Response From Otelier
Otelier confirmed the incident and stated that they are communicating with impacted customers. The company has hired a team of leading cybersecurity expert, which determined that the unauthorized access was terminated and the compromised accounts were disabled.
Additional Insights
This Otelier breach highlights the critical importance of securing cloud storage and the potential risks associated with compromised employee credentials. The attackers’ use of information-stealing malware to obtain access underscores the need for robust security measures, such as Vorlon, to proactively monitor your third party applications.
With Vorlon, Otelier could have reduced the attackers window from three months to one hour, raising different alerts that would have notified them of the breach. Here is a brief overview of some of those alerts that would have been raised for both the S3 breach and the Atlassian systems breach:- Sensitive Data Access - Vorlon will raise a sensitive data access alert whenever a new endpoint is detected that provides data which includes sensitive information
- Unknown Source IP - Vorlon will raise a new unknown source IP alert whenever traffic from a new unknown IP that cannot be identified against the catalog of apps is detected
- Unknown Source Geolocation - Vorlon will raise an unknown source geolocation alert whenever it detects traffic from a previously unidentified geolocation
While Otelier has taken steps to address the breach, organizations must remain vigilant and proactive in safeguarding their systems and data.
How Vorlon Can Help
In incidents like this, attackers often leverage exposed credentials to make seemingly legitimate requests within compromised systems. Without proactive monitoring solutions, such activity can go unnoticed until substantial damage has been done. Vorlon’s advanced monitoring and detection capabilities can identify unusual behavior patterns associated with compromised accounts, providing Security Operations Center (SOC) teams with actionable insights to mitigate risks swiftly. Deploying tools like Vorlon can significantly reduce the likelihood of attackers exploiting exposed data, ensuring compliance, protecting sensitive assets, and minimizing the financial impact of regulatory fines associated with delayed detection.
For more detailed information on this incident, refer to the original article by Lawrence Abrams at BleepingComputer.
About the Author
Jonathan Reshef
Solutions Architect at Vorlon
Jonathan Reshef is a Solutions Architect at Vorlon with ten years of software engineering and cybersecurity experience. Before Vorlon, he held technical consulting roles at IBM Red Hat, UIPath, and Palo Alto Networks. Jonathan graduated from Duke University with a degree in Electrical and Computer Engineering. Jonathan is passionate about leveraging his deep understanding of complex IT systems to help Fortune 500 companies and innovative startups prevent third-party application breaches. Connect with Jonathan and follow his latest updates on LinkedIn.