Updated on October 25, 2026
In September 2022, IHG (InterContinental Hotels Group) — owner of brands such as Holiday Inn and Crowne Plaza, with thousands of hotels worldwide — had its reservation systems and apps taken down by a cyberattack. Guests and franchisees felt the disruption globally, and the case gained notoriety when the attackers themselves gave an interview to the BBC.
A couple from Vietnam, self-styled "TeaPea", explained how they got in: a phishing email tricked an employee, they bypassed multi-factor authentication, and reached the company's internal password vault — protected by a weak, easily guessable password. From there, they accessed the most sensitive systems on the network. The initial intent was ransomware; when blocked in that effort, they turned to data destruction out of pure spite, as detailed by Infosecurity Magazine.
What actually brought the operation down
According to the attackers' account, which IHG has partly disputed, the attack didn't rely on a sophisticated technical feat but on three common failures chained together: a person tricked by phishing, a second authentication factor that could be bypassed, and , the decisive link , a credential vault protected by a trivial password. Once privileged access falls into the wrong hands, the rest of the network becomes an open door. And because the goal turned to destruction, the lack of isolated backups would have turned the incident into permanent loss.
Does your company protect privileged access with the same rigor it uses to protect the front door?
The IHG case is a prevention roadmap. Phishing awareness and simulation training reduce the first click. Phishing-resistant MFA prevents the second factor from being bypassed. Privileged access management and a password vault with a strong policy keep a single credential from becoming a master key. 24/7 detection and response contain the intruder before exfiltration or destruction. And isolated, tested backups ensure that even in the worst-case scenario, data can be recovered. None of these layers are exotic — they are exactly what managed IT services implement and monitor on an ongoing basis.
References
- BBC: IHG hack: 'Vindictive' couple deleted hotel chain data for fun
- Infosecurity Magazine: Hackers Admit Destroying InterContinental Hotels Group's Data 'For Fun'
Frequently asked questions
How did the attackers gain access to IHG's systems?
A phishing email tricked an employee, the attackers bypassed multi-factor authentication, and reached the company's internal password vault protected by a weak, easily guessable password.
What was the attackers' initial intent, and what did they do when blocked?
The initial intent was ransomware; when blocked in that effort, they turned to data destruction out of pure spite.
What key security measures does the article recommend to prevent such attacks?
Phishing awareness training, phishing-resistant MFA, privileged access management with a strong password policy, 24/7 detection and response, and isolated, tested backups.