Hotels in Italy suffer a potentially massive breach

Tens of thousands of allegedly stolen documents include high-resolution scans of passports and ID cards used by customers during check-in, according to Italian authorities.

Italy’s digital authorities have confirmed that at least some of nearly 100,000 records offered up for sale online are genuine, after multiple accommodation facilities were reportedly breached over the summer.

At least 10 hotels were affected, but the number may increase in the coming days as the investigation continues, according to Agenzia per l’Italia Digitale (AGID), which said it had intercepted an illegal sale of the documents on the dark web.

The malicious actor, operating under the pseudonym “mydocs,” claimed to have obtained the documents by breaching a booking system used by the hotels between June and August this year, with their latest post on a cybercrime forum dated August 12th.

According to AGID, the allegedly stolen records consist of tens of thousands of high-resolution scans of passports, ID cards, and other identity documents used by customers during check-in.

In Italy, it is required by law to present a valid ID when checking into a hotel or other accommodation.

“Once stolen, this data can be used for fraudulent purposes: from creating fake documents to opening bank accounts, to carrying out social engineering attacks and digital identity theft,” AGID said in a statement (machine translated from Italian).

This could have “potentially serious consequences for victims, both economically and legally,” the agency warned, urging anyone suspecting that their personal data was misused to promptly contact the authorities.

The Italian data protection authority, GPDP, said it had opened its own investigation after some of the affected hotels reported the breach, as required by law. It urged others to do the same so that authorities could “adopt the urgent protective measures provided for by law.”

“Individuals who suspect that their documents may have been unlawfully stolen are also advised to request confirmation from the facilities where they have stayed,” GPDP said in a statement.

Malicious actors frequently target hotels, and 66% of hospitality industry IT and cybersecurity executives in North America have said they expect a cyberattack this summer.