[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f34b2q9tzojk97":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":7,"domain":9,"breachDate":10,"addedDate":11,"modifiedDate":12,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":17,"affectedCount":17,"affectedCountStatus":18,"affectedCountLowerBound":19,"affectedCountUnit":20,"hasEnglishDescription":4,"severity":21,"dataClasses":22,"description":30,"seoTitle":15,"seoTitleEn":31,"seoDescription":15,"seoDescriptionEn":32,"logoUrl":33,"isVerified":4,"isSensitive":4,"isSpamList":34,"isMalware":34,"company":35},"68e3266eda11adda488252f9","otelier","Otelier Data Breach","otelier.com","2024-07-01T00:00:00.000Z","2025-01-18T06:47:39.000Z","2026-07-03T23:23:17.190Z","2026-07-18T23:55:30.479Z","Third party breach","",[],436855,"known",null,"unknown","High",[23,24,25,26,27,28,29],"Email addresses","Names","Partial credit card data","Phone numbers","Physical addresses","Purchases","Travel plans","\u003Cp>The hotel data breach is related to gaining access to the hotel management platform and obtaining customer reservation data from different hotel brands in July 2024. The scope is approximately 436,855 customer email addresses. This record was handled as a travel and hotel booking data breach; the company, country, industry, website, and data class fields were realigned with the verified scope. It was marked as sensitive due to travel plans, address, purchase, and partial card data.\u003C\u002Fp>\u003Cp>The text was rewritten to directly explain risk, scope, and action to the user. The website domain was kept as otelier.com; since the protocol was not added, a format that would cause a double https on the link side was not used. The industry was clarified as hotel management and hospitality software instead of technology.\u003C\u002Fp>\u003Ch2>Leaked Data Types and Risks\u003C\u002Fh2>\u003Cp>The types of data seen in this record are email addresses, names, partial credit card data, phone numbers, physical addresses, purchase records, and travel plans. The password field was not verified; the risk is in the context of booking and travel. Unverified payment card, bank account, private message, health record, or additional profile fields were not added to the data class list; only the supported fields were retained.\u003C\u002Fp>\u003Cp>Travel dates and hotel information can make fake reservation, check-in, payment update, or loyalty program messages appear convincing. An email address alone poses a risk of unwanted messages; when combined with phone number, address, IP, date of birth, password, travel plan, partial card data, or device data, it becomes easier for an attacker to generate a personalized message for the user. The risk assessment was conducted based on this combined effect.\u003C\u002Fp>\u003Ch2>Verified Scope and Boundaries\u003C\u002Fh2>\u003Cp>The scope was confirmed with the email address 436.855 dated July 2024. Verified fields were preserved while unconfirmed fields were left out. The incident was not combined with data sets of similar names, events from different periods of the same company, or incorrect industry references.\u003C\u002Fp>\u003Cp>No additional email addresses generated from other platforms were included in this record; the record was limited to verified customer data on the Otelier side. Domain name, company name, and industry information were kept in the narrowest accurate context possible. In areas of uncertainty, a verified flag or website field was set accordingly; thus, the user was not shown an indeterminate brand responsibility.\u003C\u002Fp>\u003Ch2>User Groups at Risk\u003C\u002Fh2>\u003Cp>User groups at risk may include customers with hotel reservations, business travelers, and customers of hotel brands using the Otelier infrastructure. Matching users should also evaluate other accounts where they use the same email, phone, username, or password pattern outside of the relevant service.\u003C\u002Fp>\u003Cp>Travel plan information is more sensitive than normal communication data in terms of physical security and fraud. If there is context of corporate email, educational account, hotel reservation, telecom subscription, gaming community, open source donation, or monitoring software, the risk of social engineering may increase. Details that seem correct are not by themselves a sign of trust.\u003C\u002Fp>\u003Ch2>Urgent Measures to Be Taken\u003C\u002Fh2>\u003Cp>Affected users should verify hotel reservations, check-in, payment updates, and loyalty program messages directly through the hotel or booking channel. For records with a password field, all accounts using the same password should be updated; for records without a password field, focus should be on the risks of email, phone, phishing, privacy, and identity matching.\u003C\u002Fp>\u003Cp>Instead of clicking on the links in the message, the address of the relevant service should be typed manually or the record in a trusted password manager should be used. Messages about shipping, account alerts, game rewards, support, donor notifications, travel reservations, security notifications, or subscription renewals should not be accepted without verification from an independent channel.\u003C\u002Fp>\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\u003Cp>Separate passwords should be applied for travel accounts, and payment notifications and unnecessary saved addresses should be cleaned up. Users should regularly clean up old accounts, unnecessary profile fields, duplicate usernames, and old phone and address information. A unique password for each service and two-step verification where possible should be a basic rule.\u003C\u002Fp>\u003Cp>From the perspective of service providers, data minimization, strong password protection, monitoring of access logs, deletion of unnecessary fields, and having user notification processes ready are required. In hotel software, travel plans and partial card data require strict retention periods and access control. Accurate scope description is also part of the security work; exaggerated or incomplete information can mislead the user into taking incorrect actions.\u003C\u002Fp>\u003Ch2>Record Control and User Action\u003C\u002Fh2>\u003Cp>The user should first check this record with their email address. If a match is found, it should be assumed that travel plans, address, phone number, and partial card data may be at risk; reservation messages should be carefully reviewed. Not finding a match does not completely rule out the use of a different email or reuse of an old password; critical accounts should also be reviewed.\u003C\u002Fp>\u003Cp>This record has been verified and updated as sensitive. In this edit, data fields were left as English canonical classes, the description visible to the user was written in Turkish and original, unverified fields were not added, and the sensitivity flag was used only when supported by the risk context.\u003C\u002Fp>","Otelier Data Breach (436.9 Thousand Reported Records)","Otelier Data Breach. 436.9 Thousand reported records were reported. Reported data: Email addresses, Names, Partial credit card data. Review the scope, risks…","\u002Fuploads\u002Flogo\u002Fotelier_com.webp",false,{"name":36,"sector":37,"country":38,"website":9,"websiteArchiveUrl":15,"websiteStatus":15,"websiteCheckedAt":19},"Otelier","Hotel Management \u002F Hospitality Software","United States"]