Best Western Hotels: Worldwide cyberattacks on tourist booking systems

At the end of February, Best Western Hotels (BWH) warned customers in emails about ongoing phishing attacks. In response to our inquiry, the hotel chain clarified the situation somewhat.

Even now, we are still receiving reader reports that after recent bookings, affected individuals are receiving phishing SMS messages that use real data. The hotel chain apparently has not yet got the problem under control.

Worldwide Problem

In response to a query from heise online, Best Western Hotels explains: “To the best of our current knowledge, this is an ongoing series of different cyberattacks on tourist booking systems and their technical infrastructure, as well as on browsers, apps, and standard software worldwide.” The subsequent statement, “According to current assessments, the incidents could also be related to forms of hybrid warfare,” seems far-fetched, however. It is not clear how this would help one of the warring parties. However, the incidents are said to affect only a “very small percentage of the total bookings made through Best Western.”

BWH further explains, “We are working with the utmost urgency and using all available means to prevent possible impairments, to comprehensively secure our systems, and to successfully defend against corresponding attacks.” The hotel chain is therefore cooperating closely with several cybersecurity companies and international law enforcement agencies such as the FBI. BWH promises to release further information as soon as the chain has reliable findings.

Remedy Apparently Difficult

BWH does not name specific booking platforms impacted by the cyberattacks. The blame placed on external booking systems and browsers, apps, and standard programs used on computers seems a bit like an attempt to shirk responsibility. This is also indicated by BWH's statement that “numerous other companies in the industry are also affected.”

The issue may persist for so long because, in particular, smaller hotels with little traffic are connected to these systems. There, operators may not implement further security measures, such as the use of separate systems for booking management and normal email and correspondence, as well as for web browsing. Due to a lack of resources, the maintenance of operating systems and software versions may also be neglected, as may employee training on cyber risks. The incidents in hotels in South Tyrol, which complained of compromised extranet access to Booking.com may also provide a further indication in this direction.

(dmk)