Otelier otelier.com Otelier data breach: what happened and what to do
In July 2024, a threat actor accessed the hotel management platform Otelier and took guest data tied to brands including Marriott, Hilton and Hyatt. 436,855 email addresses with names, phone numbers, addresses and booking details were exposed.
View all 13,115 breaches- Breach date
- Jul 2024
- Affected
- 436,855
- Data exposed
- Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases, Travel plans
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In July 2024, a threat actor gained access to Otelier, a hotel management platform, and retrieved customer data from well-known hotel brands including Marriott, Hilton and Hyatt. Otelier is used by hotels to manage reservations, transactions and invoicing, so your data can sit there even if you've never heard of the company.
Have I Been Pwned added the breach in January 2025 and counts 436,855 unique email addresses. A further 868,000 generated email addresses from the Booking.com and Expedia platforms were not loaded into the database.
What was exposed
Email addresses, names, physical addresses and phone numbers, plus booking information related to travel plans and purchases recorded by the platform. In a small number of cases there was partial credit card data.
What that lets criminals do
Travel plans make phishing believable. A message that names your hotel and dates and asks you to "confirm your booking" or "fix a payment problem" looks real. The same details can feed phone scams that pose as hotel reception.
The response
Marriott confirmed its data sat in Otelier's systems and suspended automated services from Otelier while the investigation continued. It said its own systems were not compromised. Otelier said it brought in outside cybersecurity experts, ended the unauthorized access and disabled the accounts involved.
What to do if you were in it
- 1
Verify any hotel message through the hotel
If an email or text mentions a booking and asks for payment details, contact the hotel using the number on its official website.
- 2
Be wary of calls about past stays
Scammers can use real dates and hotel names. Don't read out card numbers to an inbound caller.
- 3
Check card statements
Partial card data was exposed in a small number of cases. Report charges you don't recognise to your card issuer.
- 4
Don't click booking links in unexpected emails
Open the hotel or booking site yourself and look at your reservations there.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you know what to change. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Otelier data breach?
Have I Been Pwned lists 436,855 email addresses. Search yours there or run a free Serus scan. If you stayed at a Marriott, Hilton or Hyatt hotel, your booking could have passed through Otelier.
What was exposed in the Otelier data breach?
Email addresses, names, phone numbers, physical addresses, booking details, purchases and, in a small number of cases, partial credit card data.
Were passwords exposed?
Have I Been Pwned doesn't list passwords for this breach.
Should I change my password?
Not because of this breach, since no passwords are listed. Watch for booking-related phishing instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
