BYOD Ransomware Gang Claims IHG Hotels & Resorts, Saying a Weak LDAP Password Opened the Door to Guest and Loyalty Data

The ransomware crew that disrupted a New Mexico hospital system last month and then put Michigan State University on the defensive has picked a much bigger target. On its dark web leak site, the group known as BYOD has listed IHG Hotels & Resorts, the UK-headquartered company behind Holiday Inn, Crowne Plaza, InterContinental and a long list of other brands, and claims to be holding guest, employee and financial data from across the chain.

IHG has not confirmed any breach, and BYOD has not published evidence to back up the claim, according to Cyber Daily, which first reported the listing and said it had contacted the company. Still, the post is worth close attention, both for what it alleges and for how the attackers say they got in.

What BYOD Says It Took

The leak-site entry, tracked by RansomLook and Ransomware.live, opens by mocking the company over an LDAP binding password the group says was set to an extremely simple value. LDAP is the protocol many organizations use to let applications look up users in a central directory such as Active Directory, so a service account used for that lookup can be a valuable foothold. The gang also warned that rotating credentials would not be enough to keep it out.

From there, the list of claimed data is long. BYOD says it has customer data, AWS keys, full access to the CyberArk privileged-access system, complete employee personal information, Active Directory access and financial records. It also claims booking details such as guest names, billing addresses, companies, rate codes, room charges, taxes, spend, properties and stay dates, along with the loyalty program data store and reservation and payment ledgers. The post name-checks Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza and the Mayfair Hotel as affected brands.

Cyber Daily notes that IHG operates more than 6,800 leased and franchised properties worldwide, including 69 hotels in Australia, and estimates that a full compromise of employee data could affect more than 380,000 people. Orbitaley points out that the only widely reported IHG cyber incident to date was a separate attack in September 2022 that disrupted the company’s booking systems, and that it is not yet clear whether BYOD is alleging a new intrusion or recycling older material.

A New Gang With a Fast-Growing Victim List

BYOD only appeared this fall, but it has moved quickly. RansomLook counts 14 leak-site posts from the group, ten of them in the last 30 days. Its claimed victims include Michigan State University, where it says it holds personal data on more than a million current and former students, and the University of New Mexico, where an attack on October 26 forced the health system to divert ambulances and cancel outpatient surgeries, BleepingComputer reported. UNM later said the event affected some end-user devices but did not reach core systems or servers.

The group’s claims have not all held up equally, but some have. Cyber Daily cites PCMag’s reporting that people named in BYOD’s Trump Mobile leak confirmed they had been customers, and notes that Senator Maggie Hassan raised the incident in a letter to the company’s CEO. Michigan State said on November 3 that it is investigating a potential cybersecurity threat with law enforcement and the State of Michigan, and has not determined that any personal information was compromised.

BYOD also has an unusual public persona. After the UNM disruption, it posted an apology, offered free decryption keys for the hospital side only and said it would pay affected patients up to $2,500 each, while keeping the stolen data. It describes itself as holding companies responsible for poor security, which is a familiar justification that does nothing to reduce the harm to the people whose data is exposed.

Why It Matters for Business Leaders

Hotels sit on a goldmine of personal data. A single reservation can tie a name to a home address, an employer, a payment method, travel dates and a room number. Loyalty programs add years of history. If even part of BYOD’s claim proves true, that kind of record is ideal raw material for targeted phishing, fraud and corporate travel scams. Any business that handles bookings, memberships or customer accounts holds similar data and should treat it that way.

Service accounts are the quiet weak spot. The alleged entry point was not an exotic zero-day but a directory service account with a trivial password. Those accounts are often created once, shared across applications and never revisited. Inventorying them, giving each a long unique secret stored in a vault, limiting what they can do, and alerting on unusual use are some of the cheapest defenses available.

Franchise models multiply the attack surface. A brand that spans thousands of independently owned properties depends on shared reservation, loyalty and identity systems. A weakness in one central system can reach every hotel at once, and franchisees often have little visibility into how those systems are secured. Franchise agreements and vendor contracts should spell out security standards and breach notification duties.

Plan for the claim, not just the breach. Ransomware groups use leak-site posts to create headlines and pressure. Companies need a communications plan that lets them say quickly and accurately what they know, and to warn customers how they will and will not be contacted, before scammers fill the gap.

The Bottom Line

BYOD’s IHG claim remains unproven, and the company has not said whether its systems were breached. But the gang has already shown it can cause real disruption, and its taunt about a simple password is a reminder that many large intrusions still start with basic mistakes. For hotels, travel companies and any business holding customer records, now is a good time to audit service accounts, review privileged-access controls and rehearse the response to a public extortion claim.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous