Taj Hotel Group investigates potential data breach impacting 1.5 million customers

The Tata-owned Indian Hotels Company Ltd (IHCL), which operates the Taj Hotels, has launched an investigation into a reported data breach that potentially exposed the personal information of approximately 1.5 million customers. This breach was brought to light by the Economic Times on Thursday.

Sources indicate that the threat actor, known as "Dnacookies," is demanding $5,000 (approximately ₹4,16,549) for the complete dataset. The compromised data reportedly includes customer addresses, membership IDs, and mobile numbers from 2014 to 2020.

In response to the allegations, IHCL has stated there is no evidence of any current or ongoing security issues. The company emphasized its commitment to data security, highlighting that the customer data claimed to be in possession of the threat actor is non-sensitive.

The company has involved the Indian Computer Emergency Response Team (CERT-In) and other relevant authorities in its investigation. An IHCL spokesperson stressed the importance of customer data security and assured continuous monitoring of their systems to safeguard against any threats.

The threat actor has imposed three conditions for the ransom negotiations: the presence of a middle person with an admin designation on the forum, no data splitting, and no further data samples provided.

Despite the potential breach, IHCL maintains that there has been no impact on its business operations. The hotel group operates various hospitality properties under Taj, SeleQtions, Vivanta, and Ginger.