Express Computer
Home  »  Security  »  2 in 3 hotel websites leak guest booking details: Symantec

2 in 3 hotel websites leak guest booking details: Symantec

0 452

Two in three hotel websites leak guest booking details and allow access to their personal data to third-party sites such as advertisers and analytics companies, a new report by California-headquartered global cybersecurity company Symantec said.

“I tested multiple websites, including more than 1,500 hotels in 54 countries, to determine how common this privacy issue is. I found that two in three or 67 per cent of these sites are inadvertently leaking booking reference codes to third-party sites such as advertisers and analytics companies,” Candid Wueest, Principal Threat Researcher, Symantec, said in a statement.

All of the hotels did have a privacy policy but none of them mentioned this behaviour explicitly. Notably, it has been almost a year since the General Data Protection Regulation (GDPR) came into effect in Europe, but many hotels affected by this issue have been very slow to acknowledge, much less address it.

However, some reservation systems were commendable as they only revealed a numerical value and the date of the stay and did not divulge any personal information. But a majority of them leaked personal data including full name, email address, postal address, mobile phone number, last four digits of credit card, card type and expiration date, and passport number.

Over half (57 per cent) of the sites that were tested send a confirmation email to customers with a direct access link to their booking. This is provided for the convenience of the customer, thus, allowing them to simply click on the link and go straight to their reservation without having to log in.

“Since the email requires a static link, HTTP POST web requests are not really an option, meaning the booking reference code and the email are passed as arguments in the URL itself. On its own, this would not be an issue. However, many sites directly load additional content on the same website, such as advertisements. This means that direct access is shared either directly with other resources or indirectly through the referrer field in the HTTP request,” Wueest noted.

“My tests have shown that an average of 176 requests are generated per booking, although not all these requests contain the booking details. This number indicates that the booking data could be shared quite widely,” he added.

Get real time updates directly on you device, subscribe now.

Leave A Reply

Your email address will not be published.

LIVE Webinar

Digitize your HR practice with extensions to success factors

Join us for a virtual meeting on how organizations can use these extensions to not just provide a better experience to its’ employees, but also to significantly improve the efficiency of the HR processes
REGISTER NOW 

Stay updated with News, Trending Stories & Conferences with Express Computer
Follow us on Linkedin
India's Leading e-Governance Summit is here!!! Attend and Know more.
Register Now!
close-image
Attend Webinar & Enhance Your Organisation's Digital Experience.
Register Now
close-image
Enable A Truly Seamless & Secure Workplace.
Register Now
close-image
Attend Inida's Largest BFSI Technology Conclave!
Register Now
close-image
Know how to protect your company in digital era.
Register Now
close-image
Protect Your Critical Assets From Well-Organized Hackers
Register Now
close-image
Find Solutions to Maintain Productivity
Register Now
close-image
Live Webinar : Improve customer experience with Voice Bots
Register Now
close-image
Live Event: Technology Day- Kerala, E- Governance Champions Awards
Register Now
close-image
Virtual Conference : Learn to Automate complex Business Processes
Register Now
close-image