A significant data breach has compromised customers’ personal information from some of the world’s top hotel chains after hackers targeted a software provider, Otelier.

Otelier offers cloud-based hotel management software used by over 10,000 properties globally. In 2024, its systems were breached, exposing sensitive customer data from major hotel brands, including Marriott, Hilton, and Hyatt.

“The data included 437k customer email addresses (a further 868k generated email addresses from the booking.com and Expedia platforms were not loaded into HIBP), names, physical addresses, phone numbers, booking information related to travel plans, purchases recorded by the platform and in a small number of cases, partial credit card data,” said the HIBP (HaveIBeenPwned) data breach notification website.

Threat intelligence experts suggest that the breach may have been caused by infostealer malware, which is commonly used to steal login credentials. The malware reportedly allowed unauthorized access to Otelier’s GitHub and Atlassian accounts, opening the door for hackers to exfiltrate valuable data. A hacker known by the alias “worry” has reportedly begun selling the stolen information on BreachForums, a dark web marketplace.

Otelier has responded quickly to the breach, hiring cybersecurity experts to investigate and secure its systems. The company has disabled compromised accounts, terminated unauthorized access, and is working to strengthen its security measures to prevent similar incidents in the future. They have also been in communication with affected customers to notify them of the breach.

This incident is part of a troubling trend in which the hospitality industry has become an increasingly attractive target for cybercriminals. It also follows a similar breach involving Marriott, which agreed to pay a $52 million settlement in 2024 for a massive data breach that impacted over 130 million customers in the US.

As hotels and other companies in the hospitality sector store vast amounts of personal data, cybersecurity experts agree they must continue to prioritize security to protect their customers from further breaches.