Go Back  FlyerTalk Forums > Miles&Points > Hotels and Places to Stay > Hilton | Hilton Honors
Reload this Page >

Consolidated "Hilton Honors Account Hacked" thread

Consolidated "Hilton Honors Account Hacked" thread

Old Oct 2, 2014, 7:23 am
  #31  
 
Join Date: Oct 2014
Posts: 1
Mine HHonors account was hacked yesterday, they stole 84,000 points to buy merchandise. It's taking me a long time to get this fixed.

Anyone with an HHonors account, change your PIN asap!!!

Looks like someone from Russia did it.
mpaterso is offline  
Old Oct 2, 2014, 10:39 am
  #32  
 
Join Date: Dec 2002
Location: SMF
Programs: AA EXP 4MM
Posts: 811
Account temporarily closed by HHonors

Originally Posted by fridayskm
My Hilton HHonors account was also hacked on 9/29/14, and over 200,000 points were used for a merchandise purchase. I contacted guest services and the points were quickly returned to my account. Unfortunately, they also said that the account information should stay the same, because that would help the fraud protection department track down the culprit. Against my own best judgement, I agreed. Two days later, another 230,000 points are missing from my account. Guess it's time to spend another hour on the phone with guest services!
Yesterday I could no longer log in to my account with my account number and newly changed PIN. Today I called and I was told that: 1. HHonors had temporarily closed my account to prevent further fraud; 2. The stolen points (473,000) had still not been returned; 3. I should email the HHW loss prevention dept and find out if they were going to reopen the account or open a new account and transfer all the information.

Reading the last few posts it is clear that major HHonors account hacking is in progress.
card1953 is offline  
Old Oct 2, 2014, 11:29 am
  #33  
 
Join Date: Nov 2006
Location: Norway, Maine
Programs: United Silver and HH Diamond
Posts: 1,478
Originally Posted by controller1
United still allows sign in with FF# and PIN. Wish they would get rid of the PIN.
Why all the hate for the simple 4-digit pin? It's so much easier to remember one number for everything (including my ATM card) then all of these passwords that require lower case letters, capital letters, numbers, etc. I'll be happy when they can do retinal or finger print scans through my laptop.
ChinaShrek is offline  
Old Oct 2, 2014, 11:38 am
  #34  
 
Join Date: Aug 2004
Programs: HHonors Diamond, SPG Gold
Posts: 135
same problem

My account was just hacked also...I logged in a few nights ago and noticed my account was missing some points (about 200k) but didnt see any transactions listed in account history so i thought maybe it was a glitch, logged in next day and couldnt login anymore...couldnt request password, etc. so i called hhonors help line they just said to email hilton loss prevention because my account was closed...Got an automated response saying in 7-10 days they will review my request...

What a pain in the ......Hilton obviously has some security issues...

I'm glad i wasnt trying to book a vacation right now, i'd be screwed probably....I'm hoping I get all my points and account back...The person on the hhonors help line didnt sound suprised at all, wondering if this is happening a ton
ZackVLion is offline  
Old Oct 2, 2014, 11:38 am
  #35  
 
Join Date: Oct 2009
Location: ARN
Programs: SK EBG, BAEC Gold, LH FTL, FBP, CCG, HH Diamond
Posts: 1,533
Originally Posted by ChinaShrek
Why all the hate for the simple 4-digit pin? It's so much easier to remember one number for everything (including my ATM card) then all of these passwords that require lower case letters, capital letters, numbers, etc. I'll be happy when they can do retinal or finger print scans through my laptop.

Because a four digit PIN number can be cracked in seconds. There are only 10000 combinations.

And passwords are not difficult if you do them right. It doesn't have to be a *random* combination, it can have meaning to you...
agehall is offline  
Old Oct 2, 2014, 4:37 pm
  #36  
FlyerTalk Evangelist
 
Join Date: Jan 2005
Location: home = LAX
Posts: 25,961
Originally Posted by agehall
Because a four digit PIN number can be cracked in seconds. There are only 10000 combinations.
No, it can't be cracked in seconds if the system doesn't allow you to try to log in with the wrong PIN more than a few times in a row, before locking the account for some amount of time (24 hours, for example).

I've seen other websites (certainly bank sites) where any attempt to log in incorrectly more than a few times resulted in a temporary lock-out. And that was even with passwords, not just 4-digit PINs.

But does the Hilton HHonors site have this security feature? Or does it let someone (or some "bot") endlessly try every PIN possible?


... However: Even if the system locks you out after trying to log into one account several times with the wrong PIN, it may not lock you out if you try to log into zillions of different accounts (one time each). And statistically, if you try 10000 accounts with the same 4-digit PIN, one of them is likely to have that 4-digit PIN. So perhaps that's how the hack is working, not by guessing PINs, but by picking a PIN and guessing the account numbers that use that PIN?

Last edited by sdsearch; Oct 2, 2014 at 4:44 pm
sdsearch is offline  
Old Oct 2, 2014, 4:46 pm
  #37  
FlyerTalk Evangelist
 
Join Date: Sep 2003
Location: HH Diamond, Marriott Gold, IHG Gold, Hyatt something
Posts: 33,693
And there 20 or so PIN numbers that are often picked by customers. You search these only, and you'd get 10-20% success.

(Hint, choosing 1111 for a pin is not a good idea!)
Jaimito Cartero is offline  
Old Oct 2, 2014, 6:18 pm
  #38  
 
Join Date: Jan 2006
Location: Australia
Programs: VA Gold, United Silver, HH Diamond, PC Spire/Ambassador, Marriott Lifetime Titanium
Posts: 47
Also hacked

My account has just been hacked also.

734085 points taken for cameras - not impressed.
handy72 is offline  
Old Oct 2, 2014, 8:15 pm
  #39  
 
Join Date: May 2009
Posts: 1
Mine too!

somebody just used 81K for headphones!
geigera is offline  
Old Oct 2, 2014, 8:58 pm
  #40  
A FlyerTalk Posting Legend
 
Join Date: Sep 2009
Location: Minneapolis: DL DM charter 2.3MM
Programs: A3*Gold, SPG Plat, HyattDiamond, MarriottPP, LHW exAccess, ICI, Raffles Amb, NW PE MM, TWA Gold MM
Posts: 100,576
Originally Posted by Jaimito Cartero
And there 20 or so PIN numbers that are often picked by customers. You search these only, and you'd get 10-20% success.

(Hint, choosing 1111 for a pin is not a good idea!)
1234 isn't any better.
MSPeconomist is offline  
Old Oct 2, 2014, 10:37 pm
  #41  
Hilton Contributor Badge
 
Join Date: Jan 2009
Location: Singapore
Programs: HHonors Diamond; A3 *Nothing ; BA Exec. Club Gold
Posts: 1,704
This seems a quite significant breach,

I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.

Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..

Not a great security protocol.

Globalist
Globalist is offline  
Old Oct 3, 2014, 12:22 am
  #42  
JBD
 
Join Date: Apr 2005
Posts: 522
Originally Posted by Globalist
This seems a quite significant breach,

I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.

Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..

Not a great security protocol.

Globalist
That "protocol" was first noticed in one of the two threads I linked above (in post #5), titled "Hilton Honors Website Security".

And note that the thread (currently) ends with this post made on July 9, 2014 by the HHonorsRepresentative:

Originally Posted by HHonorsRepresentative
I'm on it! Thanks everyone. Stay tuned.
JBD is offline  
Old Oct 3, 2014, 4:13 am
  #43  
 
Join Date: Apr 2005
Location: ATL
Posts: 803
Originally Posted by card1953
My HHonors account was hacked on 9/28/14 and a large number of points were stolen. I discovered this on 9/29/14 and called and spoke to a Guest Services rep. I was given the phone number and order number for Maritz rewards and I was able to block the fulfillment of the fraudulent order. I will supposedly get the points back.
I asked the HHonors rep whether my account number should be changed (just as I would do if a credit card account was impaired). The rep did not think so but this doesn't really make sense to me. Of course changing the account number is a hassle because it is linked to credit cards, but still it would be more secure.
Anyone have any similar experience?
Yep, mine account was hacked on 9/30/14. The hackers took 466,860 points by ordering 2 Sony products. I emailed Hilton on 10/01 and also called. Within 24 hours, the points were returned and a new HHonors account number and password were issued. I think Hilton has a major security issue on their hands, although they gave me suggestions on how to protect my account. I don't use wifi or laptop/Ipad and only have one computer that is secured with Norton.
bigbuy is offline  
Old Oct 3, 2014, 7:24 am
  #44  
 
Join Date: Nov 2013
Programs: HH Diamond, IHG Spire, Marriott Gold, AA Plat. Pro
Posts: 400
Based on all of these issues. I just changed my password and PIN last night. However, I'm wondering if their site isn't falling victim to the BASH Shellshock bug or another BASH vulnerability that was recently detected. Based on the fact that their web forms don't typically work all that well, I'd find it hard to believe they have all their ducks in a row on the security side as well. I would assume this vulnerability could be used to snag account numbers. From there it may just be a matter of brute force trying PIN numbers. However, I'm not a security guy...I'm a storage guy so that's a guess from me.

Moral of the story is change your PIN and password based on what's going on.
HansGruber is offline  
Old Oct 3, 2014, 11:39 am
  #45  
 
Join Date: Dec 2002
Location: SMF
Programs: AA EXP 4MM
Posts: 811
New account

I received an email with a new account number and my points were returned--it's clearly going to require vigilance.
card1953 is offline  

Thread Tools
Search this Thread

Contact Us - Manage Preferences Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.