IHG's password vault was open to 200,000 staff behind a weak password — hackers wiped data

On a Monday in September 2022, customers of IHG, owner of Holiday Inn, Crowne Plaza and Regent with about 6,000 hotels worldwide, reported widespread problems with booking and check-in. For 24 hours the company answered complaints on social media by citing 'system maintenance'. On Tuesday afternoon it told the London Stock Exchange that it had been hacked and that booking channels and other applications had been significantly disrupted.

The attackers, who called themselves TeaPea and said they were a couple in Vietnam, told the BBC they had first planned a ransomware attack, but IHG's IT team kept isolating servers before they could deploy it, so they ran a wiper attack that irreversibly destroys data instead. They said they got in by tricking an employee into opening a malicious email attachment and bypassing a two-factor prompt, then found login details for IHG's internal password vault. The BBC reported that, by their account, the vault credentials were visible to all 200,000 staff and the password was 'Qwerty1234'.

IHG confirmed that the screenshots the hackers supplied were genuine. It disputed that the vault details were insecure, saying the attacker had to evade 'multiple layers of security' and that it uses a defence-in-depth approach.

Booking channels and other applications 'significantly disrupted' for days; IHG told investors it had been hacked; no cost figure given

According to the hackers, the vault's username and password were available to all 200,000 employees, so one compromised account opened the most sensitive systems.

The hackers said the vault password was Qwerty1234, a commonly used keyboard-pattern password.

A malicious attachment plus a bypassed second-factor prompt reportedly gave the first foothold on an employee's device.

Security expert Rik Ferguson told the BBC that sensitive data should be available only to those who need it, and that a complex password is as insecure as a simple one if left exposed.

A strong perimeter fails if the vault behind it is readable by everyone and guarded by a keyboard-pattern password. Access should be limited to those who need it, whatever the password.

IHG said customer-facing systems were returning to normal but that services might remain intermittent. The hackers said no customer data was stolen but that they held some corporate data, including email records. IHG did not accept the hackers' description of its security, and the BBC article gives no figure for the financial cost.