Indian Hotels says 'no ongoing security situation' amid report of data breach of 15 lakh Taj users

Indian Hotels on Thursday said they are investigating reports of the personal data breach of 15 lakh users from the Taj Hotel database.

The data is available on the dark web and can be bought for $5,000. Taj has raised the matter with the Computer Emergency Response Team (CERT). Since the data is from 2014-2020, the leak is expected to happen in 2020, reported Economic Times.

Regarding the whole matter, spokesperson of Indian Hotels, which runs Taj Hotels Group and is owned by Tata, told ET: “We have been made aware of someone claiming possession of a limited customer data set which is of non-sensitive nature. Safety and security of our customers' data is of paramount importance to us. We are investigating this claim and have notified the relevant authorities. We continue to monitor our systems, and there is no suggestion of any current or ongoing security issue or impact on business operations.”

A threat actor named "Dnacookies" has asked $5,000 for the entire dataset, which contains membership IDs, addresses, phone numbers, and other personally identifiable information (PII), said the report.

As per the report, the threat actor said in a post on BreachForums that the customer data is from 2014 to 2020, and he has disclosed the data to anyone until now. The person has also mentioned his three demands regarding any deal. The report also claimed that the cybersecurity watchdog and the Indian Computer Emergency Response Team (CERT-In) are aware of the breach.

A breach post was published by the actor on November 5 on the black hat hacking cybercrime marketplace BreachForums, with a sample containing 1,000 rows of unique entries, reported ET.

On Thursday, Indian Hotels' scrip on BSE closed 0.7% higher at Rs 419.7.

Also Read: Ode to Air India mascot: Delhi's Taj Mahal Hotel launches 'The Maharaja Suite'