Hotel Bookings and Privacy: How Private Data can be compromised - ERP Spain.com - España y América Latina

Although a year has passed since the General Data Protection Regulation (GDPR) came into effect in Europe, users’ personal data and privacy is still at risk. I analyzed over 1,500 hotels, airlines, and holiday attractions and found that more than half of them leak personal information such as postal addresses, email address and passport numbers. Furthermore, in some cases simple enumeration attacks were possible, which could have allowed me to access all active reservations for several large hotel chains, as well as view every ticket for an international airline. This webcast will discuss the issues we found, including topics such as: -Privacy issues with unencrypted links in confirmation emails -Brute force and enumeration attacks against booking codes -Leaking booking details to third-parties through web requests -What cyber criminals can do with stolen booking data -How data protection officers (DPOs) responded to notifications Register now