Since the end of December 2022, the internet reservations giant, Booking.com, has suffered several cyber attacks on the professional interfaces of hoteliers and their clients. A dozen Parisian hoteliers have been targeted by these attacks, but there are probably many more that haven’t yet been discovered.
The attackers use relatively "classic" phishing techniques by sending messages inviting hoteliers to click on a fraudulent link. These links contain a file that once opened infects the computers, leaving the door open for the hackers to retrieve the hoteliers' interface passwords from Booking.com. They can then easily take control of the interface, change the password, brand name, contact details, rooms and rates of the establishments and then scam the customers. The ultimate goal of these 3-stage attacks is to extort payment data from internet users who use the Booking.com platform and book with the defrauded hoteliers.
The hotel and restaurant employers' association, the GNI, believes that hoteliers aren't receiving enough support following these attacks. It also invites the victimised professionals to disconnect from Booking.com and change their password, warn their customers and above all file a complaint. For his part, Gérôme Billoi, cybersecurity expert at Wavestone, advises platforms of this type to "put in place procedures to react very quickly in the event of a cyber attack".
Indeed, this isn't the first time that booking.com has been the victim of cyber attacks. In 2014, the platform was already affected by thousands of frauds of this type.Not long ago, the company Tines published its study on mental health in cybersecurity in 2022 to update some figures.
