TRAVEL: Hacker Attack Adds Sour End To Ctrip’s Banner Week
Bottom line: Thursday’s hacking attack on Ctrip brings a sour end to its week of major new tie-ups, but isn’t too unexpected for a company of its size and should have a relatively limited impact on its operations and reputation.
I’ve been writing a lot about leading online travel agent Ctrip (Nasdaq: CTRP) these last few days after it signed a couple of major deals, so it seems fitting that we end the week with news of a major hacking attack that took the company offline for most of Thursday. I’m a longtime user of Ctrip and am generally a big fan of the company, whose good management and focus on its core travel business have allowed it to maintain its market-leading position for a decade despite numerous challenges.
Against that backdrop, this hacker attack seems like a relatively minor issue, though one that could be potentially worrisome as it exposes one of Ctrip’s biggest vulnerabilities. Then again, Ctrip is certainly not the only company to come under such attacks, and many much larger and more experienced western giants like US retailer Target (NYSE: TGT) and Hollywood studio Sony Pictures (Tokyo: 6753) came under much higher-profile and more damaging outside assaults last year.
Investors also didn’t seem too concerned about this latest attack on Ctrip, with the company’s shares dipping 1.6 percent in the latest trading session on Wall Street. Even after the dip, they are still up about 10 percent for the week, and have rallied nearly 25 percent since the middle of May after the company announced a series of tie-ups to consolidate its market-leading position.
We’ll review some of the company’s highlights from the last week shortly, but first let’s look at details of the hacker attack that made Ctrip’s website and mobile app inaccessible for most of Thursday. The service first went offline just after 11 a.m., and wasn’t completely restored until nearly 12 hours later, according to media reports. (English article; Chinese article)
At least one report said the sophisticated nature of the attack suggested it may have been carried out by a company insider seeking revenge for unspecified reasons. At one point during the outage Ctrip recommended that its users go to the site operated by its newly invested sister company eLong (Nasdaq: LONG). But then eLong said on Thursday around 6 p.m. that its site had also come under attack, even though service was restored about an hour later.
The pair of attacks do look potentially coordinated, and it’s always difficult to know what may have motivated the attackers. Revenge and access to private user data are 2 of the most common motives, though in this case Ctrip insisted no user data was stolen. The company suffered another data breach last year that prompted it to warn some customers to replace their credit cards. If no data was compromised in this latest attack, it would suggest that another motive like revenge was behind the action.
The attack brings a sour ending to an otherwise banner week for Ctrip, which announced its landmark purchase of a major stake in eLong late last week, ending eLong’s longtime alliance with US online travel giant Expedia (NYSE: EXPE). (previous post) A few days later Ctrip announced a boosting of its alliance with US giant Priceline (Nasdaq: PCLN), as it looked to fend off a growing challenge from domestic rival Qunar (Nasdaq: QUNR).
At the end of the day, this kind of hacker attack is indeed worrisome, though it’s also one of the big risks for any Internet company. How well a company handles such attacks is also quite important, and in this case it appears that Ctrip handled the situation relatively well by restoring service on the same day, albeit 12 hours later. We’ll have to wait and see if the company follows with any announcements of data breaches, but for now at least it appears the impact was large but still relatively manageable.
Related posts:
