Expedia Confirms Cyberattack Through a Third-Party Vendor: The Cloud Door Many Firms Forget to Close

Expedia Group has confirmed that attackers reached its systems through a compromised third-party data platform provider, in a supply chain attack that also hit other companies. The company told Skift on Thursday 12 November that its platforms “remain safe to use for both travelers and partners”, but it has not named the vendor or said what data was reached. An extortion group calling itself n0n claims to hold hundreds of millions of Expedia customer records; those figures are the group’s own and have not been verified.

If you have an Expedia account, there is nothing to do urgently, but be wary of emails that quote your bookings. If you run a cloud estate, this story is really about a door you may have left open yourself, and there is a check at the end worth doing this week.

#What Expedia has and has not said

Expedia’s statement, as reported by Skift and Hospitality.today, says it is aware of a supply chain attack “in which attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group.” Skift reports the company said it contained the issue as soon as it became aware and is investigating with outside security experts.

It has not said:

• which vendor was compromised;
• what kind of data was reached, how much, or whose;
• whether customers or hotel partners will be told directly.

The statement came after security sites reported claims by n0n that it had stolen Expedia data. According to Cybernews, as cited by Hospitality.today, the group says it holds 333.3 million consumer account records and has threatened to publish them unless Expedia reaches a settlement. Expedia has not attributed the attack to n0n.

#The attack it most resembles

On Monday 9 November, the cloud security firms Wiz and Sentra, working with Mandiant, published research on a campaign through Qubole, a big-data platform. Between 14 and 26 October, an attacker used credentials from an AWS account associated with Qubole to step into the AWS accounts of Qubole’s customers. Sentra counts more than a dozen organisations hit; SecurityWeek reported the same.

Skift notes that Qubole is a former Expedia vendor. Expedia has not said its breach is the Qubole one, and neither Wiz nor Sentra has named Expedia as a victim, so treat the link as unconfirmed. We cover the Qubole mechanism here because, whoever the vendor turns out to be, it is the clearest public account of how this kind of attack works.

#

How it worked, in plain terms

Many data and analytics services work inside a customer’s own cloud account. To allow that, the customer creates a role in AWS that trusts the vendor’s account, usually protected by an “External ID”, a shared code the vendor must present. AWS recommends exactly this set-up.

According to Wiz, the attacker held working credentials from the vendor’s side, presented the correct External ID every time, and every attempt to assume a customer role succeeded. To AWS, the attacker looked like the vendor. Once inside, Wiz says, it listed storage, databases and keys, read secrets from Lambda settings, Secrets Manager and Parameter Store, tested the credentials it found, and downloaded data from S3, in some cases whole buckets in one session. Sentra says it made no changes at all, which made it harder to notice.

#Why the door was open

The most important finding is not about the attacker. Sentra found that the Qubole roles were “still in place long after companies had stopped using Qubole, and those roles could read nearly all of the data the attacker went after.” Wiz says most of the roles used were not otherwise in use, and that in most environments it examined the attacker’s requests were the only activity from the vendor’s account in October.

In our view, that is the real story for IT teams. These organisations did nothing unusual. They connected a vendor the recommended way, stopped using it, and never took the access back. The weak point was trust that outlived its purpose, not a flaw in the cloud platform, and almost every organisation that has used cloud vendors for a few years will have some of it.

On Expedia’s handling, we think the statement is too thin. “Safe to use” tells travellers nothing about whether their data was taken. A company of Expedia’s size should be able to say, within days, which categories of data the attacker could reach. If UK customers’ personal data is involved and a risk to them is likely, the ICO’s guidance is that it must be told as soon as possible and, where feasible, within 72 hours, so we expect a fuller account soon. If none comes within a week, that silence will itself be telling.

#Check your own cloud this week

1. List every cross-account trust. In each AWS account, find the IAM roles whose trust policy names another company’s account. Your cloud security tool will usually have a report for “external principals”; IAM Access Analyzer can produce one too.
2. Match each one to a contract you still have. Any role for a vendor you no longer pay is a door with no reason to exist. Delete it, after confirming with the team that set it up.
3. Cut what the rest can reach. A vendor that needs one bucket should not be able to read every bucket, or your secrets. Scope each role to what the vendor needs today.
4. Look for the Qubole pattern if you ever used Qubole. Wiz’s post lists what to hunt for in CloudTrail, including role session names beginning with “quiam-“. If you find them, treat it as a breach: rotate every secret those roles could read.
5. Add vendor offboarding to your leaver process. Removing a vendor’s access should be a step in ending the contract, just as disabling an account is a step when someone leaves.

#If you are an Expedia customer

Our advice: change your Expedia password if you reuse it anywhere else, turn on two-step sign-in, and treat any unexpected email, text or call that mentions your bookings with suspicion. Expedia’s own advice, through its statement, is that its platforms are safe to use; that does not rule out criminals using stolen details to make convincing scam messages.

#Questions still open

• Which vendor was compromised, and whether it was Qubole.
• What data, and how many people, are affected. n0n’s figure is unverified.
• Whether hotel partners’ data was involved.
• Who is behind the Qubole campaign. Wiz says it has found no ties to other publicly reported activity.