EXCLUSIVE: Best Western Pwned, new facts emerging

By Davey Winder
Tuesday, 26 August 2008 18:33

Home IT

When a Scottish newspaper revealed that Best Western had been the victim of what it called the world's biggest cyber heist, the hotel chain fought back with claims that the reports of the breach were grossly unsubstantiated. I've spoken to the reporter who uncovered the breach, and seen the screenshots backing up his claims...

The world's biggest cyber heist, the newspaper exclusive said of a hotel hack. An Indian hacker had managed to successfully breach the Best Western Hotel Group online booking system and helped himself to a database containing details of 8 million customers.

A Best Western spokesperson did the decent thing and thanked the reporter for discovering the breach and disclosing it to them so they could close the hole before publication.

Indeed, that spokesperson said that "Best Western took immediate action to disable the compromised login account in question. We continue to investigate the root cause of the issue, including, but not limited to, the third-party Website that has allegedly facilitated this illegal exchange of information."

It was never going to end there, not with that headline and those numbers allegedly involved. And, of course, it did not. Best Western had a change of heart.

Now the story that is flying around the blogosphere and finding its way into print is one that claims far from 8 million customers having their personal information misappropriated, the actual number was 13 at the most.

So who do you believe? The Best Western Hotel Group or a tabloid hack and his unnamed hacker source? At first glance the temptation is to dismiss the 8 million figure as being just a headline grabber and go with Best Western on this one.

However, I have known the reporter in question for many years and can reveal that far from being a 'hack' he is, in actual fact, a highly respected investigative journalist with a couple of decades of experience in digging out stories such as this.

I spoke to Iain S Bruce about his investigation into the Best Western breach, and iTWire are the first media outlet to see screenshots of the compromised database. Find out what else we learned on page 2...

CONTINUES