Otelier breach: hotel data leaked through a vendor, not an intrusion

Hotel management vendor Otelier confirmed in January 2025 that attackers had breached its cloud systems and walked off with guest reservations, transactions and internal documents belonging to customers including Marriott, Hilton and Hyatt. The access ran from July through October 2024, per BleepingComputer's reporting of the attackers' own account and later analyses. None of the named hotel chains was intruded directly. Their data left through a supplier, which is exactly why the case deserves a place in every hotel security review.

The facts

Otelier, formerly MyDigitalOffice, provides a cloud platform that more than 10,000 hotels use to run reservations, transactions, nightly reports and invoicing. The company confirmed the compromise to BleepingComputer and said it was communicating with affected customers. Marriott confirmed the Otelier incident affected it, suspended the automated services Otelier provided pending the investigation, and stated that none of its own systems were breached.

Data samples reviewed by BleepingComputer and by Troy Hunt of Have I Been Pwned contained hotel guest reservations, transactions, employee emails and other internal records. Bitdefender added that the data picked up by Have I Been Pwned included guest names, physical addresses, phone numbers and partial payment card numbers. Passwords and full billing information do not appear to have been stolen.

On volume, from Hunt's analysis: the reservations table held 39 million rows and the users table 212 million. After deduplication, SOCRadar and BleepingComputer both report at least 1.3 million unique email addresses; once addresses auto-generated by Booking.com and Expedia are removed, Have I Been Pwned counts 437,000 unique addresses attributable to real people, and added them to its lookup service.

What remains unconfirmed

Attribution is unconfirmed. No threat group has been publicly identified in the available reporting, and the intrusion itself was described to BleepingComputer by the attackers, not evidenced by the vendor. Two elements should therefore be read as attacker claims rather than established facts. First, the exfiltration volume, put by the attackers at 7.8 terabytes, said to include millions of documents in Amazon S3 buckets managed by Otelier that belonged to Marriott: nightly hotel reports, shift audits and accounting data. Second, the entry vector: infostealer malware harvesting an employee's credentials to reach Otelier's Atlassian server, with support tickets then yielding the S3 bucket credentials, per SOCRadar's analysis. Otelier declined to go beyond its public statement when asked about the vector. BleepingComputer did independently verify, via the Flare threat intelligence platform, that Otelier employee data had been stolen by infostealer malware.

One more caution: no regulatory action had been made public as of this article's date. That observed absence says nothing about what may follow.

The mechanism, read from the defense side

The break-in stacks three ordinary building blocks, which is what makes it instructive. An infostealer, commodity malware that vacuums credentials and sessions off an employee's machine, provided the first foothold. An Atlassian server protected by nothing but those credentials opened the inside. And sensitive items, including cloud storage credentials, were circulating inside support tickets, the second improvised safe that shows up in far too many organizations.

For a hotel that uses Otelier or any comparable vendor, the lesson is not about hardening your own perimeter. It is about the supplier relationship: require multi-factor authentication on every vendor remote access path, ask in writing where secrets are stored (a ticketing system is not a vault), and hold notification clauses with defined timelines.

Consequences and outlook

The first concrete effect for guests of the affected hotels is phishing. BleepingComputer advised anyone whose address appears in the leak to treat emails impersonating the affected brands with suspicion, since a name, a phone number and the details of a real reservation make convincing bait. The second effect is structural. Marriott, Hilton and Hyatt suffered no intrusion of their own and still ended up in sample data circulating among attackers, because an intermediate link accumulated their operational records in poorly guarded S3 buckets. Attackers, believing the buckets were Marriott's, tried to extort the hotel giant with ransom notes planted in the storage, an attempt that failed.

After the incident, Otelier said the unauthorized access had been terminated, the involved accounts disabled, and a team of leading cybersecurity experts engaged for a comprehensive forensic analysis. Hotels have one real lever here: treat vendor security as an audit item with evidence, not a contract line. The Otelier case is the argument for asking for that evidence before the incident, not after.