Welcome, once again, to PWNED, where all the victims are self-owned. This week, we welcome you to a London hotel where you could check out its admin credentials for a booking website just by walking past the front desk. Our story comes courtesy of Neycho Tepavicharov, co-founder of Flashcloud, a Delaware-based web hosting company. He was staying at a hotel in London when he noticed a shocking breach of basic security protocols by management, who were a little too hospitable with their credentials. As he was passing through the lobby, Tepavicharov noticed that the door behind the front desk was open and, inside that back room, there was a whiteboard. On the whiteboard, written in plain English, were the hotel’s Booking.com administrative username and password. Anyone near the desk could clearly see the login information, and if they didn’t have time to write it down, they could have snapped a picture for later use. As Tepavicharov explains, there’s plenty of mischief you could perform with these credentials. “With that login, someone could change or cancel reservations, see guests’ names and contact details, or message guests pretending to be the hotel,” he said. “Fake ‘please confirm your payment’ messages sent from compromised hotel accounts are a well-known scam.” An attacker could potentially exploit that access to disrupt hotel operations or target guests with convincing scams. Whether the exposed credentials alone would have been enough to access the account would depend on its security settings. Tepavicharov decided to play the role of good samaritan and warn the hotel’s manager that the business was endangering itself by showing everyone its password. “I asked to speak with the manager and showed him what I’d seen. He was mortified and very grateful,” Tepavicharov said. “Nobody on staff had thought of it as a risk. It was just the easiest way for the whole team to share one login.” After Tepavicharov talked to the manager, not only did the hotel change its ways, but it also moved its website to his hosting service, Flashcloud. Tepavicharov notes that there are plenty of takeaways from this incident. Most important: give each user dedicated credentials with their own separate login, and use multi-factor authentication. “The lesson is an old one, but it keeps happening,” he said. “Shared logins end up written somewhere convenient. Give each staff member their own login, turn on two-factor authentication, and keep passwords in a password manager, not on the wall.” ®
Source: The Register — Security · 2026-11-12