Originally Posted by IMH (Post 24551877)

Today Krebs is reporting on the breach.

Other media are picking the story up, e.g. arstechnica here.

The reports suggest that the vulnerability has been fixed, or that Hilton believes it has. In which case I can't see any reason why Hilton should not (finally) be more forthcoming about what has happened and how security will be addressed going forward.

EDITED (four hours later): A post in a different thread prompted me to read the Krebs report again and with more care. It would appear only to explain some of the recent backtracking, not the earlier breach which is the main focus of this thread. Apologies for that (but it's still interesting and disappointing in its own right IMO).

Originally Posted by mnredfox (Post 24553439)

Posted on Loyalty Lobby too. Nice job Hilton.

http://loyaltylobby.com/2015/03/23/h...e-yours-again/

Time to change your PW again.

Originally Posted by anative (Post 22722174)

After the recent Heartbleed website vulnerability was announced I went through and made sure that I am using strong unique passwords on all of my web logins.

In the case of Hilton Honors that meant setting up a username and password instead of the Honors # and PIN I was using. The problem is that even after creating a Username and Password there is no way to turn off logging in with the Honors # and PIN. I thought I must be missing something so I called the Diamond Desk and was transferred to a Website person who confirmed that there is not currently a way to turn off the Honors # and PIN login.

This means that anyone with your Honors # (which is on every receipt half tucked under your room door) could hack into your account in just 9999 tries.

SCARY.

An email to Hilton's Privacy Department ([email protected]) has gone unanswered.

Originally Posted by JBD (Post 24659386)

In four days the above post will be ONE YEARS OLD.

And yet, Hilton has still not addressed this problem.

I created a new password as instructed by Hilton, I received a 1,000 bonus points for doing so.

But as I reported in the Log In thread, as of today, I can still access my online account with my old 4 digit pin (either with my username or with my HH account number).

This was the exact issue reported by OP anative on April 17, 2014, quoted above, and his alert to Hilton on this security vulnerability preceeded the major hacking attacks.

Thanks for the 1,000 points Hilton, but when are you going to fix your website? When are you going to disable access via the 4 digit pin?

Originally Posted by JBD (Post 24659386)

In four days the above post will be ONE YEARS OLD.

And yet, Hilton has still not addressed this problem.

I created a new password as instructed by Hilton, I received a 1,000 bonus points for doing so.

But as I reported in the Log In thread, as of today, I can still access my online account with my old 4 digit pin (either with my username or with my HH account number).

This was the exact issue reported by OP anative on April 17, 2014, quoted above, and his alert to Hilton on this security vulnerability preceeded the major hacking attacks.

Thanks for the 1,000 points Hilton, but when are you going to fix your website? When are you going to disable access via the 4 digit pin?

Originally Posted by MasterGeek (Post 24789558)

I am now getting fraudulent calls from telemarketers/scammers due to this data breach.

Originally Posted by MasterGeek (Post 24789558)

I am now getting fraudulent calls from telemarketers/scammers due to this data breach. I believe I'm entitled to some compensation, such as free nights, due to all this inconvenience and privacy breach. Anyone got some ?

Originally Posted by sethb (Post 24799559)

I don't believe you are. How do you know the telescammers got data from Hilton, anyway?

Originally Posted by MasterGeek (Post 24802496)

They offer a "free Hilton" night because they know I am a HHonors memeber since they got my data from there. And the timing is just a few weeks after the HHonors data breach

Originally Posted by sethb (Post 24803636)

Maybe. I've been offered free Hilton nights on telescams that went to a phone number that isn't in my Hilton profile.