Travelodge admits hack
Mealy meet mouth
Agentless Backup is Not a Myth
Travelodge has told customers who've received spam email that the company has not lost their credit card details, which is nice.
The letter said:
Our main priority is to ensure the security of our customers' data, which is why I wanted to make you aware that a small number of you may have received a spam email via the email address you have registered with us.Please be assured, we have not sold any customer data and no financial information has been compromised.
All financial data (including credit card information) is compliant with current best practice standards and is audited to PCI (Payment Card Industry) requirements. The safety and security of your personal information is of the utmost importance to us and as a result we are currently conducting a comprehensive investigation into this issue.
We take this to mean that the chain of motels has indeed had its customer database compromised.
Travelodge said it had informed the Information Commissioner's Office of the loss.
We've called the company and are waiting for a more detailed update. You can download the whole letter as a PDF here.
An ICO spokesperson said:
We have recently been informed of a possible data breach which may involve Travelodge. We will be making enquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken.Hacking is a matter for the police, but where personal data is compromised we’re interested to establish whether the data controller has met the legal requirements of the Data Protection Act, which includes having adequate security safeguards in place. As the risks to personal data evolve, the measures taken to protect it must continue to be effective.
®
COMMENTS
I got one of these on Wednesday
A spam email, from someone called "Emma Toppa" spewing crap about some company that was opening in the UK or something. Of course I ignored it.
But thanks to owning my own email domain name, and the sometimes tiresome practice of using different return names for companies I register with, if the worst comes to the worst I can always block "travelodge@my-domain.com" at the gateway, and all sorted.
"a small number"
Why do they assume only "a small number" of people have been affected? Is it because only a small number of people reported this to them, which is because only a small number of obsessive geeks are in a position have spotted the link between the spam and Travelodge, cos only very few, geeky people uniquely tag each email address they hand out to 3rd parties? There's been at least 4 of us rare OCD geeks who spotted the anomaly, the vast VAST majority wouldn't have scanned their spams with a fine tooth comb or MUCH more likely wouldn't be using or able to use such unique e-mail address so simply couldn't have known - ergo the size of the breach must be MUCH bigger - which doesn't fit with their quote of "a small number".
When they stop stating things they can't substantiate, then I'll feel comfortable trusting the rest of the statement they make.
Headline misleading
Who says its a hack, as yet it could be any number of things, data stolen by employee, badly discarded details (disk, printout, laptop etc), lost usb stick.... but hell lets go for the headline....
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
