ORIX Hotel Management: an old server of the Hundred Stay Tokyo Shinjuku hotel went missing, and about 209,000 customer records may have been taken out
A server kept in a machine room after a 2018 system migration could not be found in an asset inventory. It held booking and stay records.
Disclosed
2020-12-04
Organizations involved
1
Leaked or at risk
209K
209,000
Downtime
Unknown
What happened
Impact
The server held records of guests who booked or stayed at the hotel from July 14, 2010 to February 2, 2018. Of about 209,000 records, about 102,000 were names only, and the rest also include addresses, phone and fax numbers, mail addresses, gender and birth dates. No card or passport data was stored. There were no reports of misuse or financial loss. [1] [2] [3]
The server stayed in the on-site machine room after the data was moved to a new system in February 2018. According to ITmedia, it could not be found in an inventory in October 2020, and the loss was confirmed on December 2 after a search. [1] [3]
Timeline
- Detected 2020-12-02
- Disclosed 2020-12-04
- 2 days
Attack or cause
- Method
- [Lost device]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Organizations involved
[Breached][Moderate]Tokyo, MinatoAccommodation, food and drink209,000 leaked
ORIX Hotel Management Corporation
Sources
- [1][Official]「ハンドレッドステイ 東京新宿」のお客さま情報の紛失に関するお詫びとお知らせORIX Hotel Management · 2020-12-04
- [2][News]顧客情報約21万件含む旧サーバが所在不明 - 都内ホテルSecurity NEXT · 2020-12-07
- [3][News]オリックス孫会社、個人情報21万件入りサーバを紛失 外部に持ち出された可能性もITmedia NEWS · 2020-12-07 14:56