Notice of Data Security Incident
On 14th October 2021, we were made aware of an alleged cyber-attack threatening the security of the Centara Hotels & Resorts network. Immediately after receiving the notification, we appointed a reputable, digital forensic consultant to deploy an investigation to identify and validate the compromised data.
After the extensive and thorough forensic evaluation required to establish the veracity and details of the claim, we can confirm that a breach impacting a limited section of our network has occurred, with the general personal data of some of our customers – understood to be mostly their names and booking information, and in minor cases their phone numbers and email addresses, or some other contact information and IDs – being accessed by an unlawful and unauthorised organisation. Whilst the breach has been successfully contained, the investigation into the source, root cause and complete extent of the incident remains ongoing and we will provide more information when it becomes available.
We treat personal data and privacy with the highest levels of importance and care, and as a precautionary measure, we are asking affected guests to change their passwords as soon as possible, and to remain aware of any suspicious or unsolicited calls and/or emails requesting personal information. We can confirm that we at Centara Hotels & Resorts will not be contacting you to ask for any personal identifiable information.
Should you have any specific enquiries, you can contact our team via the following channels:
- Email: datasecurity@chr.co.th
- Telephone: +66 (0) 2100 6268
Our customers’ safety and trust are something we value of the highest importance. We are dedicated to ensuring that personal data is always kept safe, and accessible only lawfully and with our guests’ consent where applicable. We regret that this has not happened in this instance, and we are taking every possible action to further improve our security measures and prevent such a malicious attack in the future.
We will provide an update as soon as we learn more.
Thirayuth Chirathivat
Chief Executive Officer
Centara Hotels & Resorts
FAQ
Was my data accessed in this breach?
Once we confirm your identity, we will cross check it against the breached data file we have consolidated. If your name appears, we will be able to share with you what data was accessed. If your name does not appear, we will be able to confirm that your data is secure.
What personal data of mine are you holding?
We can confirm that the breach included the information provided in response to Q1. If you require complete details of your personal data with Centara Hotels and Resorts, please email your request to infosecurity@chr.co.th.
Can you delete my personal data?
Yes, we can if those are your instructions. You can include this instruction in an email to us at infosecurity@chr.co.th.
Is there anything I should be doing?
It is unlikely that there will be any consequences as only partial information was obtained, however we would recommend that you be vigilant and should you receive any request from Centara or in its name, please confirm back with us before responding or taking any action.
How did this happen?
We are working with a reputable, digital forensic consultant to confirm how the breach occurred to a small number of our systems.
