As people who read this blog regularly, you will remember that 4 weeks ago I made a post about Travelodge UK having suffered a data breach.  If you want a bit of background first, click this link to open that article in a new window, then continue reading back here.

Since that post there was a generic update from Travelodge stating that no financial data had been accessed, and that engineers were working round the clock to find out what had happened and update customers. (Basically a generic email full of platitudes, trying to sweep the issue under the carpet and keep everyone calm). That update has simply not happened. Despite repeated prompting of the Travelodge UK twitter account, the best I have received is a week ago I was told that an update would be out ‘shortly’ . I’m guessing that their definition of shortly and mine differ wildly, as I certainly don’t class a week of no action or info as shortly.

I’ll personally never stay in a Travelodge again, I simply don’t trust them with my data any more, and their lack of updates and quite frankly pathetic handling of this issue has burned what little trust or respect I may have had in them after the breach. Other large companies that have suffered data breaches in recent months have announced within a week, usually days, what has happened, what data was accessed and such like. Without this information the customers who’s details have been accessed have not got the ability to take any action to prevent further security problems that may arise from the data leaked, or even identity theft if address details were compromised. Over 4 weeks to make a full and frank disclosure to customers who have potentially had their information compromised is simply not acceptable. The lack of such update tells me that Travelodge either have inadequate systems and can’t securely protect data and audit any breach, or they simply don’t care enough to tell their customers in a timely fashion. They seem more intent on simply forgetting about the issue and hoping everyone else does, so that they don’t get any more bad publicity out of the problem.

I’d urge others to seriously consider their choice of hotel in the future, and avoid Travelodge if at all possible. if they can’t even tell us what data has been accessed or how it happened, how can we trust their word and be sure that financial data has not been accessed and therefore trust them enough to input your card details again? (and that is before you even consider that you might get your card charged twice, as they announced yesterday)

EDIT

Seems there was an update, from this, they just didn’t bother mailing anyone about it, just noticed this on their twitter feed. http://twitter.com/#!/TravelodgeUK/status/89388586784407553

It’s still entirely unacceptable in my eyes, that they haven’t even bothered to mail customers about this, that it took so long, that no numbers of how many accounts were breached but first and most importantly that they had customer details in an unencrypted database in the first place. Especially in such a database that seemingly would have no way of easily auditing or verifying who had accessed the data if it took them over 3 weeks to find out!

~Shepy