3 ms·
It's not info on 3.7M users, it's info on 3.7M reservations from 2017. Hilton has over a million hotel rooms, 3.7M reservations is nothing. Most likely this d
by gggggg5 4y ago
It's not info on 3.7M users, it's info on 3.7M reservations from 2017.
Hilton has over a million hotel rooms, 3.7M reservations is nothing.
Most likely this data comes from some OTA that was breached.
Edit: I downloaded the actual dump. It only contains 775k unique reservations from approx 450k unique people, the other 3M are just duplicates. All of the reservations are in the US, for only around 35 different properties.
The only PII contained in the dump are Hilton Honors IDs and names, there are no addresses despite the article claiming otherwise.
- dbingham 4y agoHmm... Did the dump include phone numbers?
- gggggg5 4y agoNo, and the "city", "state" and "country" fields reflect the location of the property and not the person making the reservation.
- berkle4455 4y ago3M were duplicate? I think JPMorgan may be interested in acquiring that data.
- nxm 4y agoI see what you did there
- zinekeller 4y agoFor those who don't know: JPMC had acquired Frank in Sept. 2021, which is "an online portal with tools that help students apply for and negotiate financial aid, enroll in online courses and find scholarship" (https://www.cnbc.com/2021/09/21/jpmorgan-chase-is-buying-college-financial-aid-platform-frank.html https://www.cnbc.com/2021/09/21/jpmorgan-chase-is-buying-col...). JPMC has since written it off and accuses the founder of inventing accounts to entice JPMC to acquire Frank (https://www.cnbc.com/2023/01/12/jpmorgan-chase-shutters-student-financial-aid-website-frank.html https://www.cnbc.com/2023/01/12/jpmorgan-chase-shutters-stud...).
- andrewstuart2 4y agoAnd really, that's not PII then. If it can be combined with other public data to further identify people, then it might be PII, but by itself it's really not much. I might be fuzzy on my PII trainings as they're a bit dated, but names and internal IDs are generally not considered personally identifying IIRC.
- gggggg5 4y agoSurely the combination of names, travel dates and destinations should be PII?
- tablespoon 4y ago> Most likely this data comes from some OTA that was breached. What do you mean here? I take OTA to mean "over the air," but I'm struggling to see the connection to this breach. Were reservations being transmitted by radio/satellite?
- scarface74 4y agoOTA == Online Travel Agent A third party booking site like travel.com or Priceline.com used to book hotels and airlines instead of booking directly. I never use third party sites.