A database purportedly containing 60 million customer loyalty accounts from a global hospitality group appeared for sale on a prominent underground forum, complete with verifiable samples.
The records include names, email addresses, phone numbers, loyalty balances and stay histories. Security researchers who reviewed the samples say the data appears genuine and recent, suggesting an unreported breach.
The hospitality group said it is investigating the claims with external forensic specialists. Regulators in several countries have opened preliminary inquiries into whether notification obligations were met.
Fraud analysts warn that loyalty data fuels highly convincing phishing and account-takeover campaigns, as attackers reference genuine reservations to gain victims' trust.
