InterContinental Hotels Group, also known as IHG Hotels & Resorts, has confirmed it was hit by a cyberattack that downed its booking systems and mobile apps.
U.K.-headquartered IHG operates some of the world’s largest hotel chains, including the Holiday Inn, Crown Plaza and Regent hotels. The company runs more than 6,000 hotels in more than 100 countries, including over 3,000 in the United States and serves more than 150 million guests each year.
In a Tuesday filing with the London Stock Exchange on Tuesday, the company confirmed that “parts of the company’s technology systems have been subject to unauthorized activity.”
IHG declined to confirm the nature of the incident when asked by TechCrunch but noted in the filing that “it’s working on restoring impacted systems,” suggesting a possible ransomware attack — a theory backed by some cybersecurity experts.
https://twitter.com/GossiTheDog/status/1567203783859396608
It’s unclear who was behind the cyberattack, or if or what data was stolen. IHG said in its filing that the cyberattack “significantly disrupted” its booking channels and mobile apps, which has been unusable since Monday. The hotel chain added that it’s cooperating with third-party cybersecurity experts.
When reached by email, IHG spokesperson Alex O’Neil declined to comment beyond the statement filed with the London Stock Exchange.
In a separate email, IHG spokesperson Amy Shields told TechCrunch that the incident is not linked to a recent ransomware attack on an Istanbul-based branch of IHG-owned Holiday Inn, which was claimed by the LockBit ransomware group. Shields described this attack as an “isolated incident at one of our third-party franchised hotels.”
This isn’t the first time IHG has been hit by a cyberattack. The hotel giant said in April 2017 that 1,200 of its hotels were compromised by a three-month-long cyberattack in 2016, which saw hackers access credit card data that was subsequently used to make fraudulent payments. IHG agreed to pay more than $1.5 million in a class action settlement in 2020 following the breach.
Comment