Hacker News Reader

Comment by gggggg5 | Hacker News Reader

It's not info on 3.7M users, it's info on 3.7M reservations from 2017.

Hilton has over a million hotel rooms, 3.7M reservations is nothing.

Most likely this data comes from some OTA that was breached.

Edit: I downloaded the actual dump. It only contains 775k unique reservations from approx 450k unique people, the other 3M are just duplicates. All of the reservations are in the US, for only around 35 different properties.

The only PII contained in the dump are Hilton Honors IDs and names, there are no addresses despite the article claiming otherwise.

View on HN

3M were duplicate? I think JPMorgan may be interested in acquiring that data.

For those who don't know: JPMC had acquired Frank in Sept. 2021, which is "an online portal with tools that help students apply for and negotiate financial aid, enroll in online courses and find scholarship" (https://www.cnbc.com/2021/09/21/jpmorgan-chase-is-buying-col...). JPMC has since written it off and accuses the founder of inventing accounts to entice JPMC to acquire Frank (https://www.cnbc.com/2023/01/12/jpmorgan-chase-shutters-stud...).

I see what you did there

And really, that's not PII then. If it can be combined with other public data to further identify people, then it might be PII, but by itself it's really not much. I might be fuzzy on my PII trainings as they're a bit dated, but names and internal IDs are generally not considered personally identifying IIRC.

Surely the combination of names, travel dates and destinations should be PII?

Hmm... Did the dump include phone numbers?

No, and the "city", "state" and "country" fields reflect the location of the property and not the person making the reservation.

> Most likely this data comes from some OTA that was breached.

What do you mean here? I take OTA to mean "over the air," but I'm struggling to see the connection to this breach. Were reservations being transmitted by radio/satellite?

OTA == Online Travel Agent

A third party booking site like travel.com or Priceline.com used to book hotels and airlines instead of booking directly. I never use third party sites.

Reply on news.ycombinator.com