The Intercontinental Hotels Group (IHG), which owns Holiday Inn, was the victim of a destructive cyberattack carried out by hackers who claimed to have done it “for fun.”
According to the BBC, the IHG identified a couple from Vietnam and claim that after an unsuccessful ransomware attack, the couple erased a significant amount of data.
The hackers gained access to the FTSE 100 company’s databases and quickly discovered the password was Qwerty1234.
The hackers, calling themselves TeaPea, contacted the BBC via the encrypted messaging app Telegram, providing screenshots as proof of the hack.
The images show they gained access to the company’s internal Outlook emails, Microsoft Teams chats, and server directories, which IHG has confirmed are genuine.
“Our attack was originally planned to be ransomware but the company’s IT team kept isolating servers before we had a chance to deploy it, so we thought to have some funny [sic]. We did a wiper attack instead,” one of the hackers said.
A wiper attack is a cyber-attack that destroys data, documents, and files permanently.
According to an expert, the case demonstrates the vengeful side of criminal hackers.
UK-based IHG owns and operates 6,000 hotels around the world under the Holiday Inn, Crowne Plaza, and Regent brands.
Customers reported widespread problems with booking and check-in on Monday last week, according to the report.
For 24 hours, IHG responded to social media complaints by stating that the company was “undergoing system maintenance.” The company then informed investors on Tuesday afternoon that it had been hacked.
According to the IHG, customer-facing systems are returning to normal, but services may remain intermittent.
The hackers showed no remorse for the damage they had done to the company and its customers.
“We don’t feel guilty, really. We prefer to have a legal job here in Vietnam, but the wage is an average of $300 per month. I’m sure our hack won’t hurt the company a lot.”
According to the hackers, no customer data was stolen, but they did obtain some corporate data, including email records.
