wildthing271

Haven't posted on here for a while.... but there is obviously a major hack going on judging by the number of folks on here just hacked...and add me to that list - this morning I had over 250000 points, I then got an email from the Hilton Hhonors Shopping Mall thanking me for my purchase....I checked my account and I only had 1000 points left.....someone had changed all the address and email preferences...but for good measure they must have noted my email address and are now spamming it.....

Michelle at the Diamond Desk was very sympathetic and helpful though!

Be vigilant folks!

scubaccr

Sorry this won't save you. Yes you can choose an account name and password , which is what I did durng my HH signup some years ago.

However on my first call to HH desk, i was asked by phone system before being put through for account number and 2 random first/second/third/fourth digits of my pin number, to screen and confirm ones userid so that when you reach live person you are already validated.

The HH person I queried when put through said , i still have a PIN number and they caused it to be emailed, which i immediately reset and deliberately forgot.

So any hacker can try any number of 'madeup' account numbers of right length and pin passwords of 0000-9999 as an easy bruteforce hack. ACCT/ PIN combo is still associated even if you used name/password from signup day instead.

Obviously hacker is only interested in high value accounts pointswise for redeeming the points. On IHG Summer2012 it was to untraceable amazon e-vouchers to the accounts changed email address (IHG did not notify original email address of such email address changes)


I think it is crazy that elite programs expect us to remember some long 8-12-16 digit member number, where ever possible I use a name instead (so much easier to remember), and also a password if allowed (versus a pin). Some of my programs now belatedly allow the name-type extra signon such as KLM for me .. although as both me/girlfriend registered on same email address we can't make use of the KLM change.

jtumbleweed

Well add us to the growing list! 550,000 points....Ouch!! Good thing we booked a Hawaii trip with 350,000 points or they would have taken those. Account is now frozen...and being told to be patient while they work things out. Good to hear people are getting their points back! Right? Would love to hear if anyone has any suggestions..as to what worked for them to get their points back. Not only is the Pin system archaic but I think emailing your actual password or pin when requested is old too. Seems like most sites ask you to answer secret questions or ask you to change your password in order to give you access...so Hilton if you're reading this...time to update! My husband travels "a lot". He loves being a diamond member and likes staying at Hilton hotels. Ok I'm done ranting Good to have a place to vent...thanks.

helosc

Seems like something is happening re security :
When I just logged in now with password and pin code, I was also asked to type in the numbers shown on a picture.

fozziedoggie

It's a small step, but we really need to be able to select a more robust password overall. Most of my banking passwords, etc., are over 10 digits.

nrr

Many websites let you set-up a 2-step verification system: if you are not using a "known" computer to login, you must enter a 2nd code--sent to your cellphone as a text message (or home phone, as a voice mail message); this is inconvenient, but helpful in defeating hackers.

bradcc

add one to the victims list... just had a few hundred thousand points drained to purchase some british gift cards..

working with CS to open a fraud case now..

blackjack-21

Looks like the locked in CC problem still exists, as I'm currently in contact with the HHonors rep on FT who's also working on getting my CC removed from the Hilton website. So the problem still exists and the "delete" button still doesn't work, at least for me. And I tried different end dates, tried to switch the CC number, still the original number and dates come up. So it's not a new problem, and should have been resolved by Hilton many months ago.

bj-21.

JBD

Exactly!

The issues in this thread were brought to Hilton's attention several months ago. The HHonorsRepresentative supposedly was "on it".

But now we've had not an insignificant number of people reporting they've had their accounts hacked and points stolen (which as noted up thread was always my primary concern with the sorry state of security on Hilton's website), as reported here:

http://www.flyertalk.com/forum/hilto...r-changed.html

I keep linking all these threads in the hope that the main issue, Hilton's website not safeguarding our accounts, would receive more attention so that Hilton would be more pressured to get this fixed - now.

And question to the community: has anyone seen these reports of hacked accounts on any of the other boards or blogs? Any report of this in any hotel trade papers?

If not, why? Data breaches usually get a lot of coverage.

Can we at least make a sticky with these threads?

This matter is not trivial.

USAF_O1

I just received several emails from HHonors where someone has hacked into my account, changed ALL of my information to an address in Poland, my PIN number, my email address, password, etc. They also spent over 195,000 of my points on a Beats by Dr. Dre headset. I called HHonors and they said I'm not the only one with this problem, several others have called in. GO INTO YOUR ACCT NOW AND CHANGE YOUR INFORMATION!!

Hope no one else has been hacked!

HansGruber

There is another thread on this.

http://www.flyertalk.com/forum/hilto...r-changed.html

You are the first to report this since they added captcha but I have a feeling they got your data before that.

Yellowjj

Curious, if they changed your email address how did Hilton send you an email informing you? I would think the account would send any mail to the newly listed email.

pmarrsouth

Do they email the old address, once it is changed to new email address, stating that the account's email address has been updated and to please contact them asap if it was not done by the account holder?

flyer4512

When you make any changes to your Hilton account I believe you get an email t verify you made the changes.


When I log into Hilton now see word challenge so they are addressing the problem

wildthing271

As soon as I was aware of the 'hack' I called the Diamond Desk..it took some time with the involvement of their fraud team, but they took a new email address from me...my account was then locked for about 10 days which caused some pain, but after that I received a new account number, and my points were restored....