Jointly US-Dutch owned Booking.com was illegally accessed by an American attacker in 2016 – and the company failed to tell anyone when it became aware of what happened, according to explosive revelations.
The alleged miscreant, named as “Andrew”, is said to have stolen “details of thousands of hotel reservations in countries in the Middle East,” according to a new book written by three Dutch journalists.
Their employer, Dutch title NRC Handelsblad, reported the allegations this week, claiming that Booking.com had relied on legal advice from London-based law firm Hogan Lovells saying it wasn’t obliged to inform anyone of the attack.
The breach was said to have occurred after “Andrew” and associates stumbled upon a poorly secured server which gave them access to personal ID numbers (PINs), seemingly unique customer account identifier codes. From there the miscreants were able to steal copies of reservation details made by people living and staying in the Middle East. NRC Handelsblad linked this to espionage carried out by the US against foreign diplomats and other people of interest in the region.
Although the accommodation booking website reportedly asked the Dutch AIVD spy agency for help with the breach after its internal investigation identified “Andrew” as having connections to US spy agencies, it did not notify either its affected customers or data protection authorities in the Netherlands at the time, the newspaper allged.
When we asked for comment about the allegations, a Booking.com spokesperson told us: “With the support of external subject matter experts and following the framework established by the Dutch Data Protection Act (the applicable regulation prior to GDPR), we confirmed that no sensitive or financial information was accessed.
“Leadership at the time worked to follow the principles of the DDPA, which guided companies to take further steps on notification only if there were actual adverse negative effects on the private lives of individuals, for which no evidence was detected.”
The breach predated the EU’s General Data Protection Regulation (GDPR), meaning data protection rules everyone’s familiar with today, which (mostly) make it illegal not to disclose data leaks to state authorities, did not exist at the time.
Booking.com was fined €475,000 earlier this year by Dutch data protection authorities after 4,100 people’s personal data was illegally accessed by criminals. In that case employees of hotels in the UAE were socially engineered out of their account login details for the platform.
The apparent online break-in once again raises the spectre of European countries being targeted by Anglosphere intelligence agencies. The infamous Belgacom hack, revealed by Edward Snowden in 2013 and reignited in 2018 when Belgium attributed it to the UK, was carried out by British spies trying to gain access to data on people of interest in Africa.
Almost exactly eight years ago, Snowden also revealed the existence of a British spy-on-diplomats programme codenamed Golden Concierge, which on the face of it looks remarkably similar to the Booking.com breach reported this week.
While some readers might shrug and mutter “spies spy,” evidence of the theft of bulk data by third parties who may or may not be subject to whatever lax controls spy agencies choose to create for themselves will be cold comfort to anyone who made a Booking.com reservation in the Middle East at the time. ®