Sotetsu Hotel Management: 3,093 reservation records of Hotel Sunroute Taipei were stolen from a relay server at a Taiwanese contractor, and customers got scam calls posing as the hotel

1. 2021-03-13

   A customer reported a call from someone posing as hotel staff who used a refund of the room charge as a pretext to get the customer to operate an ATM or to ask for credit card data. The hotel began investigating. [1]

2. 2021-03-29

   The hotel found that the local Taiwanese vendor providing its hotel management system had been hacked and that customer data had leaked. [1]

The data that may have leaked is reservation data, 3,093 records, of customers who booked through outside travel sites between November 1, 2020 and March 10, 2021. It included names, phone numbers, stay dates and room charges. [1]

The server hit was a relay server used to pull data from five booking sites: Booking.com, Expedia, Ctrip, Hotelbeds and Rakuten. The operator explained that the data was taken as it passed through the server, not extracted from a database, and that the hotel's own management system did not leak it. [1]

No actual financial loss was confirmed. The operator urged customers to beware of impersonation calls that urge ATM operations or ask for card data. Its hotels in Japan use a different system and are not affected. Travel to Taiwan was restricted, so the effect in Japan seems small, but the operator did not say whether reservations from Japan were included. [1]