SHANGHAI police said they had launched an investigation into the alleged massive data breach of Huazhu Group Ltd., one of China’s largest hotel operators.

An online post emerged Tuesday, containing nearly 500 million pieces of information related to the hotel group’s customers, including registration information, personal data and booking records of the group’s wide range of hotel brands.

Thirteen hotel brands belonging to Huazhu, including Hanting Hotel, Crystal Orange Hotel, VUE, CitiGO and Grand Mercure Hotels, are said to be involved in the leak.

According to Changning District police Tuesday evening, they received a report from the hotel group and will crack down on any illegal information transactions. The police also urged companies to strengthen their protection against data breaches.

Huazhu has also started a self-inspection and hired a technology company to verify the source of the information being sold online.

Zpower, an intelligence provider on anti-cyber crimes, said the leaked information was real after running a check. It’s speculated the leakage may have occurred after Huazhu’s programmers uploaded its database connection to GitHub, a web-based software repository hosting service.

Huazhu responded twice on its official Sina Weibo account Tuesday, saying it had reported the case to the police and hired a professional technology company to verify if the private information sold online was from Huazhu. It said it couldn’t prove the information for sale is authentic and had started an internal investigation to make sure its clients’ information is safe.

Shanghai police confirmed it had received Huazhu’s report. Huazhu, established in 2005, manages more than 3,000 hotels in more than 370 cities in China, employing near 70,000 staff members. Its brands cover high-end, midrange and mass markets.

The leakage reflected the hotel company’s management and technical problems, said Ma Xiaolong, a professor with the College of Tourism and Service Management at Nankai University.

A contract is formed after a consumer pays a hotel lodging fee, so the hotel is obliged to protect the safety of the consumer, including personal security, privacy and information security, Ma said.

The Law on the Protection of Consumer Rights and Interests stipulates operators should take technical and other measures to safeguard information security, to prevent leaking consumers’ private information.

(Xinhua)