This week's intelligence reveals a troubling pattern of prolonged access breaches affecting North American consumers and businesses. Microsoft disclosed details of a large-scale credential theft campaign targeting more than 35,000 users across 13,000 organizations in 26 countries, while the hospitality sector faced significant exposure through BWH Hotels' six-month compromise. These incidents highlight how threat actors are maintaining persistent access to extract maximum value from their intrusions.
BWH Hotels Guest Data Exposed for Six Months
BWH Hotels, the parent company of Best Western, WorldHotels and SureStay, confirmed a major data breach that exposed sensitive customer information. The global hospitality company, which operates more than 4,500 hotels across 100 countries, detected unauthorized activity in a web application containing guest reservation data on April 22. Most concerning, the company acknowledged that attackers had maintained access to the network for more than six months.
BWH Hotels CTO Bill Ryan, who penned the notification email, said names, email addresses, telephone numbers, and/or home addresses belonging to "certain guests" were accessed by an unauthorized third party. The intruders also accessed reservation details, such as reservation numbers, dates of stay, and any special requests. While financial data was not compromised, thousands of reservations tied to Best Western and other BWH brands may have been exposed, raising concerns over targeted phishing attacks against travelers.
Microsoft Warns of Massive Credential Theft Campaign
Microsoft disclosed details of a large-scale credential theft campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries. The campaign used code-of-conduct-themed phishing lures, combined with legitimate email services, to redirect users to attacker-controlled domains and steal authentication tokens.
The phishing emails featured polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible and convincing than typical phishing attempts. This represents a significant evolution in threat actor sophistication, targeting business users through corporate communication channels they trust.
Education Sector Under Siege
Instructure Inc. became a target of a ransomware attack that was orchestrated by the ShinyHunters ransomware group. As per the listing on a darkweb forum, nearly 9000 schools have been affected by the data breach, with over 3.65 TB of data compromised, belonging to 275 million people, including students, teachers, and other staff.
Of the 8,809 entries, confirmed figures include 2,514 higher education institutions - among them all eight Ivy League universities, major state university systems, and internationally recognized institutions including Oxford, Cambridge, NUS, and the University of Melbourne - and 1,616 K–12 school districts, including large urban systems such as Clark County (Las Vegas), Houston ISD, and Miami-Dade.
What Individuals Should Do This Week
Hotel guests should immediately review reservation confirmations and be extremely cautious of booking-related communications. BWH Hotels advised guests to be "extra vigilant" when viewing any unexpected or suspicious communications about hotel stays. If you receive a suspicious communication such as an unexpected email, text, WhatsApp message, or telephone call that asks for payment, codes, logins, or 'verification,' even if they reference a BWH Hotels property or an upcoming reservation, do not engage.
For the Microsoft credential campaign, verify any corporate policy or compliance emails through official company channels before clicking links or downloading attachments. Enable multi-factor authentication on all business accounts immediately.
What Businesses Should Do This Week
Organizations must audit their web applications for unauthorized access immediately. Health care organizations should strengthen third-party security oversight, enforce strict access controls, continuously monitor networks for suspicious activity and maintain strong incident response processes to reduce the impact of breaches involving sensitive patient data.
Hospitality and education sectors should implement enhanced email security measures and conduct immediate security awareness training focusing on sophisticated phishing attempts. Review all vendor access permissions and implement network segmentation to limit breach impact duration.