Hilton member accounts info, trip dates open to plunder A pair of security researchers have found a basic flaw that allows anyone to steal email and home address information, trip data, and spend points of Hilton Worldwide "HHonors" loyalty club members. The cross-site request forgery is tied to a password reset initiative the company launched offering 1000 points to those who took …
I remember reading about this several months ago - HHonors hacked, with the miscreants using the pilfered points to purchase gift cards and merchandise from the Hilton store - and thinking it odd, typical, craven (you pick) that no memo was sent out with advice on how to respond to guests' possible questions regarding the situation.
Is this a new attack or just a rehash of that incident? Or am I psychic and was seeing into the future?
The original attack took place and was referenced in the article. Hilton sent out notification to their customers* that they should change their passwords. This is a kick-em-while-they're-down attack.
*Some but not all of their customers got this notification. I didn't get anything even though I have an HHonors account. Nor have they ever sent out any sort of notice to me that they had been hacked. So it seems it was only for a subset of their members, which is a telling indication of their current security practices.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
