Sign in / up

back to article Travelodge admits hack

Travelodge has told customers who've received spam email that the company has not lost their credit card details, which is nice. The letter said: Our main priority is to ensure the security of our customers' data, which is why I wanted to make you aware that a small number of you may have received a spam email via the email …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Marvin the Martian
    IT Angle

    Just what I needed

    a spammed reminder of a night in hell.

    2 1
  2. Anonymous Coward
    Anonymous Coward

    mealy mouthed ?

    Quite prompt and succinct admission.

    Not excusing the security failure - but less bad than some others

    3 1
  3. frank ly

    Why store credit card data?

    Why do suppliers store customer credit card data?? Only the credit card companies should have any credit card details stored.

    2 1
    1. Mark 125
      Reply Icon

      RE:

      They do this because some BA believes that if want convince (i.e. not having to re-enter card details,) rather than security. Additionally card details (though again which card details are relevant,) for tracking usage of cards in the case of fraudulent usage or charge backs.

      That said, card details should be stored in a PCI-DSS compliant store, so there should be no way of accessing the card data via the payment solution, just a reference token.

      1 0
      1. dave 46
        Reply Icon

        title

        No good if your PCI-DSS compliant data store gets compromised too.

        Far less likely than someone getting an SQL injection past your badly coded web front end but still possible.

        0 0
    2. irish donkey
      Reply Icon
      WTF?

      Every tried to get them to remove your credit card data

      Any site which takes your Credit Card data stores your data 'to make your return visit much easier'

      The ability to remove your own data with the click of a button seems to most logical step but doesn't encourage your customers to return. Clearly trying to tie you into their brand takes a much higher priority over customer data security.

      Buy a Kindle from Amazon and you never have to input you data again. All your eBooks purchases are automatically charged to the same card. Found this out when I bought a neice a kindle for her birthday. Helpful.

      1 0
      1. Skoorb
        Reply Icon

        You can get your details off Amazon, have been able to do it for over 10 years now.

        Turn off "1 Click" here: https://www.amazon.co.uk/gp/css/account/address/view.html/ref=ya__32

        Delete credit cards here: https://www.amazon.co.uk/gp/css/account/cards/view.html/ref=ya__29

        It's not great, but it's doable.

        Both of these are listed on the "your account" page, which is linked to at the top of every page on Amazon.

        0 0
      2. Skoorb
        Reply Icon

        I forgot

        You may also want to take a shufty at https://www.amazon.co.uk/gp/yourstore/pym/cc/ref=ya__7 and https://www.amazon.co.uk/gp/advertising/oo/ref=ya__64

        0 0
      3. Captain TickTock
        Reply Icon
        Facepalm

        Kindle

        the gift that keeps on giving....

        0 0
  4. Anonymous Coward
    Thumb Down

    Headline misleading

    Who says its a hack, as yet it could be any number of things, data stolen by employee, badly discarded details (disk, printout, laptop etc), lost usb stick.... but hell lets go for the headline....

    2 0
  5. Rogerborg

    My financial data hasn't been compromised?

    Well, yesterday you said that about my email.

    0 0
  6. jewelie
    Thumb Down

    "a small number"

    Why do they assume only "a small number" of people have been affected? Is it because only a small number of people reported this to them, which is because only a small number of obsessive geeks are in a position have spotted the link between the spam and Travelodge, cos only very few, geeky people uniquely tag each email address they hand out to 3rd parties? There's been at least 4 of us rare OCD geeks who spotted the anomaly, the vast VAST majority wouldn't have scanned their spams with a fine tooth comb or MUCH more likely wouldn't be using or able to use such unique e-mail address so simply couldn't have known - ergo the size of the breach must be MUCH bigger - which doesn't fit with their quote of "a small number".

    When they stop stating things they can't substantiate, then I'll feel comfortable trusting the rest of the statement they make.

    2 0
  7. Anonymous Coward
    Anonymous Coward

    Which site got hacked?

    Travelodge have had 2 sites on the go for a while now. The new one went up for a week earlier this year but got pulled down and replaced by the old one (on www2.travelodge.co.uk). It seems like the new site has gone back online recently.

    Any clues as to which one was compromised?

    0 0
  8. Anonymous Coward
    Anonymous Coward

    I got one of these on Wednesday

    A spam email, from someone called "Emma Toppa" spewing crap about some company that was opening in the UK or something. Of course I ignored it.

    But thanks to owning my own email domain name, and the sometimes tiresome practice of using different return names for companies I register with, if the worst comes to the worst I can always block "travelodge@my-domain.com" at the gateway, and all sorted.

    2 0
  9. Anonymous Coward
    Unhappy

    Oh great...

    Just one week after I actually sign up and book online for the first time...

    0 0
  10. Anonymous Coward
    Anonymous Coward

    Error handling doesn't inspire confidence

    The fact that the new site gives a Java error when you give it malformed input isn't very encouraging

    "Error 500: java.lang.NumberFormatException: For input string: "zzz""

    Furthermore it seems to fall over (perpetual timer bar) when you do a search for a hotel with a double quote in the hotel name box.

    All in all it doesn't exactly inspire confidence!

    1 0
  11. Anonymous Coward
    Anonymous Coward

    Kindle

    "Buy a Kindle from Amazon and you never have to input you data again. All your eBooks purchases are automatically charged to the same card. Found this out when I bought a neice a kindle for her birthday. Helpful."

    From what I recall when I bought mine they do send you an email to explain that they will set it up on your Amazon account and that if its a gift for someone else then they give you a link to a page where you can sort this out.

    However, the fact that its set up onto "1-click" purchasing is something I'm still not entirely happy about ... I'd much prefer it if they allowed an option to require a password before anything gets purchased.

    0 0
  12. Captain TickTock
    Unhappy

    Not so cheap and cheerless

    Stayed in a Travelodge in Newcastle last year.

    Had to make the extra bed ourselves (apparently customers like to make it their own way)

    No soap or hair/shower product provided to reduce costs.

    Worst bed I've ever slept in.

    After the first night, cancelled the next 2 nights, and booked in with Theophilus P. Wildebeest AKA the Purple Throbbing Monster. Not a lot dearer, but definitely a notch above.

    0 0
  13. Anonymous Coward
    Anonymous Coward

    Did travelodge use Silverpop or Epsilon for their email marketing?

    http://www.theregister.co.uk/2010/12/15/silverpop_breach_probe/

    http://www.theregister.co.uk/2011/04/03/epsilon_email_breach/

    0 0
  14. Anonymous Coward
    FAIL

    That statement looks carefully worded

    I may be paranoid but "financial data" by itself, at least to me, appears possibly to refer only to the company's financial data - not cardholder data due to them "including" it with financial data in the PCI paragraph. PR/Legal probably approved that statement. To be fair, if I had customers reporting data loss like they do, I wouldn't definitively say cardholder data wasn't exposed until I had completed log and config reviews, preferably with an outside contractor double-checking everything. Maybe not even then.

    Important distinction: Not having found evidence that a breach occurred isn't the same thing as not having a breach. If customer complaints were the first incident indicator they noticed... that doesn't give me a warm fuzzy about their security monitoring.

    1 0
  15. Peter Clarke 1
    Coat

    Blame the Teddys

    Where did this data come from?

    Travelodge, Boss

    Shouldn't have employed those two for the TV advert

    0 0
  16. beedeejay

    Poor Webserving

    They haven't taken their old site off line. I wonder how much poor code with direct access to the databases (via the login authentication mechanism) is still freely available to anyone with some brains?

    http://www.travelodge.co.uk/index.html redirects to http://www2.travelodge.co.uk/index.php

    Try

    http://www.travelodge.co.uk/homepage.html to get to the old site.

    Also, lets make it reveal their webserver and TCP port? Simple..

    http://www.travelodge.co.uk/nopage.html

    No inspiring some old code doesn't have an exploit now is it.

    Pffft

    0 0
  17. irish donkey
    Thumb Down

    Received an email

    I stayed in Travel Lodge 4 years ago and they we still storing my details on their server.

    There data retention policy needs a serious looking at. Hopefully the credit card I used with them should have expired in this time but I have no way of knowing as it was so long ago.

    0 0
This topic is closed for new posts.