Skift Take

Hackers have found a weak link in security — its hotel partners. And the threat to customers has been stubbornly persistent.

Scammers have been targeting customers for years, and in the latest attempt to find victims, they have reportedly been placing ads on the dark web to obtain the passwords of Booking’s hotel partners.

“Hackers are increasing their attacks on customers by posting adverts on dark web forums asking for help finding victims,” the BBC reported last week. “Cyber-criminals are offering up to $2,000 (£1,600) for login details of hotels as they continue to target the people who are staying with them.”

The way the typical scam works is that fraudsters gain access to a hotel’s extranet. They install malware, access passwords, and mimic IP addresses as a way to bypass two-factor authorization. The cyber criminals use the hotel partners’ login credentials to enter their accounts, and then send urgent messages to customers prodding them to send funds to the scammers or risk losing their reservations, for instance.

Is It a Hack of emphasizes that the hackers aren’t gaining access to’s backend systems, but acknowledges that the scammers indeed have broken into hotel partners’ accounts.

The hackers can then send communications to customers/hotel guests, urging them to send money to the fraudsters.

“The hackers then message customers from the official app and are able to trick people into paying money to them instead of the hotel,” the BBC reported. “Hackers appear to be making so much money in their attacks that they are now offering to pay thousands to criminals who share access to hotel portals.”

On a The Hidden Wiki, a popular dark web directory, “ Scam” is the top trending topic. Source: The Hidden Wiki issued this statement about the issue: “While this breach was not on, we understand the seriousness for those impacted, which is why our teams work diligently to support our partners in securing their systems as quickly as possible and helping any potentially impacted customers accordingly, including with recovering any lost funds.” — and other online players such as HomeAway/Vrbo years ago — have been the targets of these sorts of cyber crimes for an extended period of time, and has been unable to make the problem disappear.

The company said it helps customers recoup lost funds, supports its partners in trying to make their systems secure, and has been publishing best practices on how to avoid these scams.

Have a confidential tip for Skift? Get in touch

Tags: booking holdings,, cyber security, security

Photo credit: A photo of headquarters in Amsterdam in 2013. Source: This file is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported license. Attribution: Khaledattalla at English Wikipedia.

Up Next

Loading next stories