> JapanHacked_
[Resolved][Severity: Moderate][Lost device]

ORIX Hotel Management: the December 2019 guest ledger of Cross Hotel Osaka went missing from storage, leaving the data of 9,629 guests unaccounted for

The December 2019 guest ledger could not be found in storage. It was most likely discarded by mistake before its retention period ended.

Disclosed

2021-03-17

Organizations involved

1

Leaked or at risk

9.6K

9,629

Downtime

Unknown

What happened

  1. An employee visiting the warehouse found that the guest ledger for December 2019 was missing. [1]

Impact

The ledger binds the registration cards guests fill in at check-in. It held, for 9,629 stays between December 1 and 31, 2019, names, genders, birth dates, addresses, phone numbers, email addresses and nationalities. Passport information is managed separately and was not included. [1]

The warehouse is locked and only employees can enter. The company disposes of ledgers past its internal five-year retention period, and explained that this one was most likely discarded by mistake before that. It has received no report of misuse or secondary damage. [1]

Timeline

  1. Detected 2021-03-10
  2. Disclosed 2021-03-17
  3. 7 days

Attack or cause

Method
[Lost device]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Gender][Date of birth][Postal address][Phone number][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]保管期間中の宿泊台帳が所在不明に - オリックス・ホテルマネジメントSecurity NEXT · 2021-03-17