FlexBooker Breach Exposes 3.76M Accounts, Including Partial Credit Card Data
What Happened — In December 2021 the online booking service FlexBooker suffered a data breach that exposed 3,756,794 user records. The breach originated from a compromised account within FlexBooker’s AWS environment, allowing attackers to extract email addresses, names, phone numbers, password hashes and partial credit‑card data. The stolen data was later observed being traded on a public hacking forum.
Why It Matters for Trust & Control Assurance —
- A compromised cloud account illustrates the scenario a continuous access‑control monitoring program is built to detect and prevent.
- Maintaining auditable evidence of privileged‑access reviews and MFA enforcement provides a defensible trail for regulators and auditors.
- Demonstrable due‑diligence around identity governance strengthens trust with customers and partners.
Who Is Affected — SaaS booking platforms, hospitality businesses, and any end‑users whose personal data was stored in FlexBooker.
Recommended Actions —
- Conduct an immediate IAM audit of all cloud accounts; enforce MFA for privileged users and rotate credentials.
- Deploy continuous monitoring of privileged‑access logs and retain evidence for audit readiness.
- Review data‑handling policies to ensure encryption and tokenization of payment information. Source: https://haveibeenpwned.com/api/v3/breach/FlexBooker
Technical Notes — Attack vector: compromised AWS account (stolen credentials). Exposed data types: email, name, phone, password hashes, partial credit‑card numbers. No public CVE associated. Source: https://haveibeenpwned.com/api/v3/breach/FlexBooker