A spy software named “Pctattaletale” was recently discovered on computers used to register guests at several Wyndham hotels in the United States. This software was found to be collecting and publishing screenshots containing personal information of customers.
The program continuously took screenshots of the internal software used by the hotels, capturing details of reservations and customer data. Due to a vulnerability in the spy software, these screenshots were easily accessible from the internet.
The vulnerability in Pctattaletale was uncovered by security researcher Eric Dage during his investigation of consumer spy software. This program could discreetly monitor devices running Android or Windows without the knowledge of the device owner. However, the vulnerability allowed for the direct download of screenshots from Pctattaletale’s servers.
Screenshots obtained from two Wyndham hotels, as provided by TechCrunch, revealed names of guests, reservation details, and partial payment card numbers. Another screenshot showed access to the Booking.com Reservation Service.
It remains unknown who installed the spy software on the networks of these companies, with possibilities ranging from remote attackers to internal employees or owners themselves.
While one hotel’s management claimed ignorance of the spy software, representatives from two other hotels did not respond to inquiries. Wyndham’s spokesperson, Rob Mayers, confirmed that each hotel in the network is independently operated and controlled by owners.
Booking.com stated that their systems were not compromised in this incident, highlighting the vulnerability of hotel systems to cyber threats.
Such applications, known as “Stalkerware” for their secretive monitoring capabilities, pose a serious threat to privacy. This breach underscores the importance of enhancing control and security measures to protect personal data of hotel guests.
This incident is not the first data breach involving Wyndham hotels. Between 2008 and 2010, the hotel chain experienced three cyber attacks resulting in the theft of customer data and payment information. The US Federal Trade Commission even levied charges against Wyndham for failing to adequately protect customer data during those incidents.