Shanghai police investigate data leak of 130 million hotel clients available on dark web for 8 bitcoin

Shanghai police are investigating one of the largest data leaks on the mainland that could affect about 130 million clients of Huazhu Hotels Group.

Huazhu, which owns more than 10 hotel brands and manages more than 3,800 hotels across 382 mainland cities, reported the data breach on Tuesday after finding a post on a dark web forum about the sale of its clients’ personal data and booking information.

According to local media, the leaked information potentially includes 240 million lines of data containing phone numbers, email addresses, bank accounts and booking details, and was available on the dark web for 8 bitcoin or about US$56,000.

“Those who commit illegal acts including theft, trading and exchange of residents’ personal data will be heavily punished,” the Shanghai police said in a statement. “We are resolute in protecting people’s interest and ensuring information security.”

A Huazhu official said on Wednesday morning that progress has been made in the investigations, but she did not reveal further details.

The dark web is a small part of the deep web that is not indexed by web search engines, where sites sell drugs, counterfeit money and much more.

The media reports said the data could have been hacked in early August when Huazhu programmers uploaded information to GitHub, a service that allows engineers to collaborate on developing software coding.