Shanghai police, Huazhu Hotels Group investigate client information leak

Huazhu Hotels Group has reported to Shanghai police after news that some 500 million pieces of client information were leaked went viral on social media on Tuesday.

Huazhu Hotels, a major operator of hotel chains in China, said in a statement on its official Sina Weibo account on Tuesday that selling or leaking personal information is in violation of the laws, and asked those involved in the case immediately stop their illegal act and surrender themself to the police as soon as possible.

“We have reported the case to the police and hired a professional technology company to verify if the private information sold online was from Huazhu,” it added.

Established in 2005, Huazhu owns over 10 hotel brands including Hanting Hotel, Crystal Orange Hotel, VUE, CitiGO, and Grand Mercure Hotels, and manages over 3,800 hotels across 382 mainland Chinese cities.

According to media reports, the leaked information potentially includes 123 million pieces of registration data on Huazhu’s official website, such as name, mobile number, ID number and log-in pin; 130 million pieces of check-in records, such as name, ID number, home address and birthday; and 240 million pieces of hotel stay records, such as name, credit card number, mobile number, check-in and check-out time, expenditure and room number.

In an interview with the Beijing News, a Huazhu employee said there the hotel couldn’t prove that the information for sale is authentic and had started an internal investigation to make sure its clients’ information is safe.

Shanghai police confirmed it had received Huazhu’s report and was investigating the case.

“Those who commit illegal acts including theft, trading and exchange of residents’ personal data will be severely punished,” the police said in a statement. “We are resolute in protecting people’s interest and ensuring information security.”

The leakage reflected the hotel company’s management and technical problems, said Ma Xiaolong, a professor with the College of Tourism and Service Manangement at Nankai University.

A contract is formed after a consumer pays a hotel lodging fee, so the hotel is obliged to protect the safety of the consumer, including personal security, privacy, and information security, Ma added.

The incident happened as Beijing stepped up efforts to crack down on illicit data market, and has triggered heated discussions on social media.

“I booked a Hanting room last week due to examination. But now I was told my personal information has been leaked. Maybe we can trust nobody in this society,” Weibo user xintengqinaideni said.

“I have been numb to personal information leak after so many rumors. It often happens in China, and people have few ways to safeguard their legitimate rights. What a pity,” Weibo user hailei-hou said.

Shares of New York-listed Huazhu tumbled 4.4 percent to $33.98 on Tuesday.