Otelier Data Breach (2024)

On July 1 2024, 437,000 Otelier customers appeared in a new dataset published by Have I Been Pwned. The breach originated from the hotel management platform Otelier, which processes reservations for major chains including Marriott, Hilton, and Hyatt. The exposed information includes names, email addresses, phone numbers, physical addresses, travel plans, purchase records, and, in a limited number of cases, partial credit card data.

Primary Disclosure Details

The Have I Been Pwned listing states that a threat actor gained access to Otelier’s systems and extracted customer records tied to well-known hotel brands. The notification confirms 437k customer email addresses were compromised along with names, physical addresses, phone numbers, booking details, purchases, and partial credit card data in a small subset of records. An additional 868k generated email addresses created through Booking.com and Expedia integrations were identified but not loaded into the breach database. The disclosure does not specify the exact intrusion method, the precise date of initial access, or whether a ransom demand was made.

Why This Matters for You and Your Family

When your hotel booking data is stolen, the exposure reaches far beyond a single reservation. Names paired with home addresses and phone numbers allow scammers to craft convincing calls or texts claiming fraudulent charges on recent stays. Travel plans and purchase histories can be used to impersonate you with airlines, loyalty programs, or family members. Even partial credit card data combined with booking details increases the risk of card-testing fraud or unauthorized account changes. For families, a single parent’s breach can expose children’s travel information if they were included on the same booking, creating long-term risks that extend to every household member.

Doxxing and Identity-Chain Risks

The combination of email addresses, phone numbers, and physical addresses forms a powerful starting point for doxxing chains. Attackers can correlate this data with gaming accounts, social profiles, or school records to map an entire household. Credential leaks of this nature frequently cascade into account takeovers on loyalty programs, email, and linked financial services. Children’s gaming accounts are especially vulnerable because parents often reuse passwords or security questions derived from travel memories. Once one link is established, the entire identity chain can be sold or exploited across dark-web markets.