Beautiful Virgin Islands

Monday, Aug 04, 2025

Hotel WiFi across MENA compromised and exposing private data

Hotel WiFi across MENA compromised and exposing private data

Cybersecurity researcher uncovers faulty system used by hotels in the Middle East surrendering personal information on millions of guests worldwide.

Pakistani cybersecurity researcher Etizaz Mohsin was in a hotel room in Qatar when he unexpectedly discovered a technical vulnerability in its internet system that exposed the private information of hundreds of hotels and millions of guests worldwide.

Mohsin told Al Jazeera he was “stunned” by what he uncovered late last year.

“I found out that there is a service running rsync [file synchronization tool], which allows me to dump the files of the device to my own computer,” Mohsin explained. “I was able to access the sensitive information of all other hotels which were using the FTP [file transfer protocol] server for backup purposes.”

From his hotel room he was able to obtain network configurations of 629 major hotels across 40 countries, and the personal information of millions of guests, including their room numbers, emails, and dates they checked in and out of the hotel.

The data included that of major hotel chains across the Middle East and North Africa region, including the Kempinski, the Millennium, Sheraton, and St Regis in Qatar, Turkey, the United Arab Emirates (UAE), Saudi Arabia, Lebanon, Egypt, Bahrain, Oman, Jordan, Kuwait and Bahrain.

The hotels all use an internet system called HSMX Gateway by British company AirAngel. Its clients are among the largest hotel brands worldwide.

This is common practice; most hotels, malls, restaurants, and cafés require people to create an account and fill their information after connecting to the internet in order to start using it. However, it is not without its risks.

“A public WiFi network is fundamentally less secure than one you use at home,” Mohsin explained. “It allows hackers to monitor and intercept data sent across the link, giving them access to sensitive information such as banking credentials and account passwords.”

The HSMX Gateway incident is similar to a vulnerability in hotel routers researchers discovered seven years ago, which affected 277 devices in hotels and convention centres in the United States, Singapore, the United Kingdom, the UAE, and 25 other countries.


‘Stakes are high’


Cybersecurity consultant Ragheb Ghandour told Al Jazeera the ease of access to this data, especially with how centralized it is among hundreds of hotels, is a huge cause for concern.

“Let’s say a spy checks into one of these listed hotels, skims through the files and finds a point of intrusion. They could modify – or mirror – the landing page for the WiFi connection and all the clients of the hotel would send their information straight to them,” Ghandour said. “The stakes are high. You could wreak havoc through the hotel.”

It is not just guests’ personal information that is at risk. Mohsin said a hacker could use the vulnerability to access the guests’ computer and mobile devices, as well as the hotel’s security footage, ventilation systems, and electronic door locks.

In fact, assassins used a vulnerability in a luxury hotel’s internet to unlock an electronic door and carry out a targeted killing in Dubai 12 years ago.

In 2010, a hit squad, reportedly members the Israeli Mossad intelligence agency, assassinated senior Hamas official Mahmoud al-Mabhouh at a luxury hotel in the Emirati city after hacking the key system to enter al-Mabhouh’s room.

AirAngel said in a statement it stopped updating its software in November 2020, and the firm encouraged clients to replace it with a new service called Captivnet. The issue with the previous service remains unfixed, however.

AirAngel added only a small number of clients have not migrated to Captivnet and still use HSMX Gateway. But more than half of the hotels Mohsin discovered compromised continue to use the service.

Of the 629 hotels Mohsin found with faulty internet protection, 378 have not switched to AirAngel’s new service, including more than 100 in the UAE, Saudi Arabia, Qatar, Lebanon, Egypt, and other countries across the MENA region, he said.

Mohsin said he hopes his findings will encourage more people to improve their digital security.

“Always a use a VPN to encrypt all your data as it travels via the network via secure tunnel,” he explained. “Alternatively, you might use mobile data [instead of WiFi] to avoid the dangers in the first place.”


Newsletter

Related Articles

Beautiful Virgin Islands
0:00
0:00
Close
Pilots Call for Mental Health Support Without Stigma
All Five Trapped Miners Found Dead After El Teniente Mine Collapse
Ong Beng Seng Pleads Guilty in Corruption Case Linked to Former Singapore Transport Minister
BP’s Largest Oil and Gas Find in 25 Years Uncovered Offshore Brazil
Italy Fines Shein One Million Euros for Misleading Sustainability Claims
JPMorgan and Coinbase Unveil Partnership to Let Chase Cardholders Buy Crypto Directly
Declassified Annex Links Soros‑Affiliated Officials and Clinton Campaign to ‘Russiagate’ Narrative
UK's Online Safety Law: A Front for Censorship
Nationwide Protests Erupt in Brazil Demanding Presidential Resignation
Parents Abandon Child at Barcelona Airport Over Passport Issue
Mystery Surrounds Death of Brazilian Woman with iPhones Glued to Her Body
Bus Driver Discovers Toddler Hidden in Suitcase in New Zealand
Switzerland Celebrates 734 Years of Independence Amid Global Changes
U.S. Opens Official Investigation into Former Trump Prosecutor Jack Smith
Leaked audio of Canada's new PM Mark Carney admitting the truth about the Net Zero agenda: "We're gonna make a lot of money off of this."
China Enforces Comprehensive Ban on Cryptocurrency Activities
Absolutely 100% Realistic EVO Series Doll by EXDOLL (Chinese Company) used mainly for carnal purposes
World Economic Forum founder Klaus Schwab: "In this new world, we must accept... total transparency. You have to get used to it. You have to behave accordingly. But if you have nothing to hide, you shouldn't be afraid."
Meet Mufti Hamid Patel, head of Office for Standards in Education in Pakistan
George Soros tells the World Economic Forum: "President Trump is a con man and the ultimate narcissist, who wants the world to revolve around him."
Hamas are STARVING the hostages.
Decline in Tourism in Majorca Amidst Ongoing Anti-Tourism Protests
British Tourist Dies Following Hair Transplant in Turkey, Police Investigate
Poland Begins Excavation at Dziemiany After New Clue to World War II‑Era Nazi Treasure
WhatsApp Users Targeted in New Scam Involving Account Takeovers
Trump Threatens Canada with Tariffs Over Palestinian State Recognition
Trump Deploys Nuclear Submarines After Threats from Former Russian President Medvedev
Trump Sues Murdoch in “Heavyweight Bout”: Lawsuit Over Alleged Epstein Letter Sets Stage for Courtroom Showdown
Germany Enters Fiscal Crisis as Cabinet Approves €174 Billion in New Debt
Trump Administration Finalizes Broad Tariff Increases on Global Trade Partners
J.K. Rowling Limits Public Engagements Citing Safety Fears
JD.com Launches €2.2 Billion Bid for German Electronics Retailer Ceconomy
Azerbaijan Proceeds with Plan to Legalise Casinos on Artificial Islands
Former Judge Charged After Drunk Driving Crash Kills Comedian in Brazil
Jeff Bezos hasn’t paid a dollar in taxes for decades. He makes billions and pays $0 in taxes, LEGALLY
China Increases Use of Exit Bans Amid Rising U.S. Tensions
IMF Upgrades Global Growth Forecast as Weaker Dollar Supports Outlook
Procter & Gamble to Raise U.S. Prices to Offset One‑Billion‑Dollar Tariff Cost
House Republicans Move to Defund OECD Over Global Tax Dispute
Botswana Seeks Controlling Stake in De Beers as Anglo American Prepares Exit
Trump Administration Proposes Repeal of Obama‑Era Endangerment Finding, Dismantling Regulatory Basis for CO₂ Emissions Limits
France Opens Criminal Investigation into X Over Algorithm Manipulation Allegations
A family has been arrested in the UK for displaying the British flag
Mel Gibson refuses to work with Robert De Niro, saying, "Keep that woke clown away from me."
Trump Steamrolls EU in Landmark Trade Win: US–EU Trade Deal Imposes 15% Tariff on European Imports
ChatGPT CEO Sam Altman says people share personal info with ChatGPT but don’t know chats can be used as court evidence in legal cases.
The British propaganda channel BBC News lies again.
Deputy attorney general's second day of meeting with Ghislaine Maxwell has concluded
Controversial March in Switzerland Features Men Dressed in Nazi Uniforms
Politics is a good business: Barack Obama’s Reported Net Worth Growth, 1990–2025
×