© 2022 Shangri-La Group. All Rights Reserved.
ICP license: 17055189
ICP license: 17055189
Shangri-La Group recently discovered unauthorized activities on our IT network. We immediately engaged cyber forensic experts to investigate and contain the issue. The investigation revealed that between May and July 2022, a sophisticated threat actor managed to bypass Shangri-La’s IT security monitoring systems undetected, and illegally accessed the guest databases of the following properties:
Certain data files were found to have been exfiltrated from these databases but the investigation has not been able to verify the content of these files. The databases contained guests' contact information but personal information such as dates of birth, identity and passport numbers, and credit card details, was encrypted. There is no indication that any guest data has been misused.
This incident has not impacted our operations and steps have been taken to further strengthen the security measures of our IT networks. We have notified the relevant authorities as well as affected guests.
We deeply regret any inconvenience or concerns this incident may cause.
We first noticed suspicious activities on our IT networks in July 2022. We immediately engaged forensic experts to investigate and contain the issue.
The investigation revealed that a sophisticated threat actor managed to bypass Shangri-La’s IT security monitoring systems undetected, and illegally accessed guest databases in a number of our properties in Asia between May and July 2022.
Our network security monitoring services identified suspicious activities on our IT networks.
We would like to assure you that all necessary steps have been taken to ensure that our IT systems are secure.
No, our systems have not been affected.
There is no impact on our booking systems or operations, and it is safe to continue booking with our properties globally.
We have deployed additional monitoring technologies throughout our systems and are taking measures to further reinforce system security.
Certain data files were found to have been exported from the databases but the investigation has not been able to verify the content of these files.
We can reassure guests that more sensitive data was encrypted, including passport numbers, identification numbers, and dates of birth, as well as credit card numbers with expiry dates.
From our security monitoring, there is no evidence that any personal information has been misused. Although we believe the risk of harm to guest is low, we encourage guests to be on the lookout for any suspicious activities or notifications across their accounts.
As the investigation is still ongoing, we are unable to provide details.
We are treating this matter very seriously and have engaged experts to investigate this incident. The investigation is still underway. In the meantime, we have taken all necessary steps to further strengthen the security of our networks.
Our investigation confirmed that networks at the following properties containing guest data were accessed by unauthorised third parties:
The investigation was carried out with the utmost urgency to determine the nature and extent of the incident and to contain the threat. Guests were notified as soon as we were assured that our system was secure.
Our investigations show that certain data files were exported from the databases of the affected hotels. However, we have not been able to verify the content of these files. We have decided to notify guests out of an abundance of caution.
The databases contained some combination of guest names, e-mail addresses, phone numbers, postal addresses, Shangri-La Circle membership numbers, reservation dates, and company names.
We would like to emphasise that more sensitive data was encrypted, including passport numbers, identification numbers, and dates of birth, as well as credit card numbers with expiry dates.
There is no impact on Shangri-La Circle accounts.
Our security monitoring services are following the situation closely and we have not seen any evidence that any guest data has been misused or disclosed. Also, more sensitive data on the affected servers, such as dates of birth, passport or ID numbers and credit card details, was encrypted.
No. More sensitive data, including passport numbers, dates of birth, and credit card numbers with expiry dates was encrypted and is therefore not at risk.
Yes, you are not affected by this incident.
No. This issue affected servers located in a few of our hotels in Asia and has since been contained. There is no impact on bookings and operations.
We have further strengthened our IT networks and databases. It is safe to continue booking with our properties globally.
If you have stayed at any of the affected hotels, it is likely that your personal data was in the databases of these hotels.
If you have not stayed in any of the affected hotels, you are not affected by this incident.
We have notified guests of affected hotels based on the available contact information.
While we are not aware of any guests having suffered any harm, we encourage you to have a heightened awareness across your accounts, including looking out for any suspicious activities or notifications across your accounts.
Experian is a third-party identity monitoring service provider that can monitor the web, social networks, and public databases for personal information you have provided.
Experian provides identity monitoring services to residents based in the following destinations:
Australia, Austria, Brazil, Canada, Denmark, Finland, France, Germany, Hong Kong, India, Ireland, Italy, Malaysia, Mexico, Netherlands, New Zealand, Norway, Poland, Portugal, Singapore, Spain, South Africa, Sweden, Switzerland, Turkey, United Kingdom, United States, Puerto Rico, Guam and US Virgin Islands.
This is an added precaution and optional service. How much information you provide is completely at your discretion.
The service is valid from 30 September 2022 for one year, while registration should be completed by 31 December 2022 using the unique code in our email notification.
If you receive an alert, it means Experian has found a match to personal information you provided, in an at-risk location. It does not mean that fraud has occurred. We encourage you to be on the lookout for any suspicious activities or notifications across your accounts.
No. We are offering affected guests an identity monitoring service for one year on a complimentary basis.
As the service is provided by Experian, we are unable to follow-up on your behalf. Please email Experian directly at globalidworks@experian.com with any technical questions related to signing-up for the service.
Signing up for the service was available until 31 December 2022 and the activation code has been expired after this date.
Signing up for the service was available until 31 December 2022 and the activation code has been expired after this date.