Hi @Nanna
Yes, this is a well-known problem and affected several of our customers in the past.. Most likely cause is that one of your staff members either googled the Mews Login page and was redirected to a fake page, or clicked on a false link in an email.
This then directs the user to a fake login page, where they enter their credentials and 2FA authentication. The user is then logged into the Mews application and does not notice something just happened.
The attacker then can also login to Mews and downloads reservation reports, which they then exploit. We had cases over email as well as over WhatsApp.
Google “Man-in-the-middle” attack to get more technical details, this is a well-known form of attach and affects many solutions, f.e. booking.com as well (not a Mews particular problem!).
Actions:
- Contact Mews Support asap. They have a dedicated team for this sort of security incidents and can tell you what user is probably affected.
- Reset passwords on all users
- Train staff to never google the Mews login page or react to emails. Always use browser favorites to access Mews.
- Depending on the country where you are, contact your data protection officer asap. In several countries, there are regulations in place that you need to inform authorities in a very short time after you took notice of such a data breach
- Decide on proactive guest communication. In our experience, the phishing emails will cause lots of feedback from guests within 48-72 hours after appearing, then it calms again. Make a good decision if you want to proactively inform all guests or not, also potentially include legal advise on this. Decide on statements to pass to guests on the phone and train your staff accordingly.
- Start a detailed written protocol of your actions, with date/time. Depending on country, data protection officers and authorities will want this.
- Search Mews community and support forum. There are several posts and articles there with further useful information.
Best, Marc
