Indian Hotels, the entity behind Taj Hotels Group, is actively investigating reports surrounding a potential data breach impacting approximately 1.5 million users from their database. Allegedly, this data, spanning from 2014 to 2020, has surfaced on the dark web with a price tag of $5,000.
The matter has been escalated to the Computer Emergency Response Team (CERT) by Taj, seeking resolution and further guidance. Economic Times reported that the suspected leak is believed to have occurred in 2020.
In response to these claims, an Indian Hotels spokesperson reiterated their steadfast commitment to customer data security. They acknowledged being notified of a limited dataset, deemed non-sensitive, allegedly in possession of an unidentified entity. Emphasizing the utmost importance of data security, they stated ongoing investigations and proactive engagement with relevant authorities. The spokesperson also affirmed continuous system monitoring, asserting no current or ongoing security threats affecting business operations.
The alleged threat actor, identified as “Dnacookies,” has purportedly offered the entire dataset for $5,000, encompassing membership IDs, addresses, phone numbers, and personally identifiable information (PII), as per reports. The actor’s demands for any potential transaction were outlined, drawing attention to the gravity of the situation.
Reportedly, the individual behind the breach disclosed this information for the first time on BreachForums, a black hat hacking cybercrime marketplace, on November 5. A sample of 1,000 unique entries from the dataset was shared, shedding light on the extent of the potential breach.
Acknowledging the breach, both the cybersecurity watchdog and the Indian Computer Emergency Response Team (CERT-In) have been made aware, as outlined in the reports.
In financial markets, Indian Hotels’ scrip on the BSE closed 0.7% higher at Rs 419.7 on Thursday. The situation remains under investigation and scrutiny as authorities work diligently to assess the magnitude and implications of this reported breach.
