The cyber attack on the Intercontinental Hotels Group (IHG), which operates the Holiday Inn brand, was reportedly carried out “for fun”.
The perpetrators of the attack, who claimed to be a couple from Vietnam, told the BBC (opens in new tab) the “attack was originally planned to be a ransomware but the company's IT team kept isolating servers before we had a chance to deploy it”.
The hackers, who also go by the name of “TeaPea”, then decided to “have some funny” before switching to a “wiper attack”, a variety of attack which deletes the user's data permanently without ransoming it for financial gain.
IHG attack
The full scope of the incident has not yet been revealed, however, IHG said in a statement (opens in new tab) that its booking channels and other applications had been “significantly disrupted”.
The hackers told the BBC they used the widely-used password “Qwerty1234” to access the company's most sensitive databases.
Before this, TeaPea gained access to the IHG IT systems by tricking an employee into downloading malicious software via a phishing email.
They also had to bypass an additional security prompt message sent to the worker's devices as part of a two-factor authentication system.
The hackers maintained that they didn't steal any customer data, though they did manage to access some corporate data such as emails according to the sources.
Despite the attack turning malicious, the original motivations behind it were economic.
“We don't feel guilty, really,” they told the BBC. “We prefer to have a legal job here in Vietnam but the wage is an average $300 per month.”
They added: “I'm sure our hack won't hurt the company a lot.”
In contrast to some of the hacker's claims, an IHG spokesperson told the BBC that hackers would have needed to have evaded “multiple layers of security” to get into systems.
She said: “IHG employs a defence-in-depth strategy to information security that leverages many modern security solutions”.
Wiper attacks are often used by national states for political ends due to the chaos they can cause.
The US National Security Agency (NSA) has alleged that the Russian government used the “AcidRain” malware to disrupt Viasat's satellite network via data deletion around the time of their attack on Ukraine.
- Scared of ending up as the next high-profile cyber attack? Checkout our guide to the best endpoint protection
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba