> JapanHacked_
[Resolved][Severity: Moderate][Lost device]

ORIX Hotel Management: an old server of the Hundred Stay Tokyo Shinjuku hotel went missing, and about 209,000 customer records may have been taken out

A server kept in a machine room after a 2018 system migration could not be found in an asset inventory. It held booking and stay records.

Disclosed

2020-12-04

Organizations involved

1

Leaked or at risk

209K

209,000

Downtime

Unknown

What happened

  1. An inventory of company assets could not locate a server holding about 209,000 customer records. Because removal from the premises could not be ruled out, the company filed a damage report with the police and set up an internal investigation team. [1] [2]

  2. The company disclosed the case. [1] [2]

Impact

The server held records of guests who booked or stayed at the hotel from July 14, 2010 to February 2, 2018. Of about 209,000 records, about 102,000 were names only, and the rest also include addresses, phone and fax numbers, mail addresses, gender and birth dates. No card or passport data was stored. There were no reports of misuse or financial loss. [1] [2] [3]

The server stayed in the on-site machine room after the data was moved to a new system in February 2018. According to ITmedia, it could not be found in an inventory in October 2020, and the loss was confirmed on December 2 after a search. [1] [3]

Timeline

  1. Detected 2020-12-02
  2. Disclosed 2020-12-04
  3. 2 days

Attack or cause

Method
[Lost device]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Gender][Date of birth]

Organizations involved

Open in organization search

Sources

  1. [1][Official]「ハンドレッドステイ 東京新宿」のお客さま情報の紛失に関するお詫びとお知らせORIX Hotel Management · 2020-12-04
  2. [2][News]顧客情報約21万件含む旧サーバが所在不明 - 都内ホテルSecurity NEXT · 2020-12-07
  3. [3][News]オリックス孫会社、個人情報21万件入りサーバを紛失 外部に持ち出された可能性もITmedia NEWS · 2020-12-07 14:56