Dutch travel firm BCD hacked, 700,000 customers reportedly hit

Hacking group ShinyHunters says it has stolen the data of 700,000 customers of BCD Travel, a Dutch-owned business travel company, and has already begun publishing the data on the dark web, the Financieele Dagblad reported on Wednesday.

The group, which was responsible for February’s record-breaking hack on telecoms company Odido, has posted a file of more than 30 gigabytes online, Jordy Bovenschen of Leusden-based cybersecurity firm Passguard told the paper.

In a written statement, BCD said it had recently spotted suspicious activity on an internal account and had taken steps under its own security protocol, bringing in outside specialists to determine the scope of the breach.

It has not confirmed the scale of the attack or what ransom has been demanded. It added that its services had not been disrupted and its IT systems were working normally.

According to ShinyHunters, the attackers reached a customer database running on Salesforce, the customer-management software, as well as internal SharePoint sites used by staff to share documents. The group set BCD a deadline of June 1 to pay or see the data released.

The Odido link

ShinyHunters has been active for more than six years and specialises in stealing data and demanding payment to keep it private, rather than locking up a victim’s systems. Previous targets include ticket seller Ticketmaster and the company behind the Canvas education platform.

Its attack on Odido in February was the largest in Dutch history, exposing the personal data of more than six million current and former customers after an employee was tricked into entering login details on a fake site. Odido’s data appeared on the dark web after it refused to pay.

BCD Travel is based in Utrecht and is part of BCD Group, with reported sales of $24.4 billion last year.