Only bloggers affected by Hyatt data breach?

Hyatt had a minor data breach recently and so far, it only seems to be affecting bloggers. I’m sure a few people are feeling schadenfreude at this news, but it’s not that big of a deal…so far as I know. 

Update: Hyatt clarified that this breach wasn’t blogger specific. It had to do with hotels being notified of top consumers, some of whom happened to be bloggers.

What happened

Yesterday, I received a call from two different Hyatt reps, asking me to call them immediately about an urgent account issue. Like most phone calls I get these days, I figured this was a scam. I called back and left a message, but wasn’t 100% convinced it was legit so I DM’d the Hyatt Concierge. They confirmed that the call was legit and someone would reach out on my cell phone shortly.

About a half-hour later I received a call from someone at Hyatt’s Omaha office. I don’t remember what the exact department was called, but according to OMAAT, who received the same call, it was the “care and regulation team.” 

Apparently, information about one of my reservations was shared internally and four other individuals were mistakenly cc’d on it. They saw my name, address and Hyatt account number. These four people were asked to delete the email immediately and my account was being monitored for a more serious breach.

Cause for concern?

None of that was particularly alarming to me. You can look up anyone’s address on the internet these days. My Hyatt number isn’t exactly my social security number and unless they also had my password, I wasn’t worried. 

The leaked reservation information was for a stay at the Hyatt Place Pasadena back in February. Despite the urgency with which they had tried to get a hold of me, she was kind of downplaying it on the phone. 

It all sounded fine to me and I thanked her for letting me know about this breach, which didn’t seem like a big deal. 

Reports from other bloggers

A few hours later I saw a tweet from Kat stating that she had received a similar call from Hyatt. It turns out we weren’t alone:

so, so far it’s you, @OneMileataTime , @CKaway , @dealswelike and @TheForwardCabin and me. I’m guessing we know everyone that got calls. Frequent flyer Bloggers with globalist status? how about @thepointsguy ?

— Will Run For Miles (@katruns26point2) July 31, 2019

According to Kat, the emails were intended to inform the hotels of “special guests.” Considering I booked the Hyatt Place a few hours before I actually showed up (and I don’t even have status with Hyatt), I have my doubts about that. Here’s what else we know about this leak, based on feedback from Kat and Ben:

• This breach only impacted 15 people.
• In every case, four unauthorized people reportedly got cc’d in email communications between World of Hyatt and a Hyatt Place.

This has happened before

About a year ago, something like this happened to me in reverse. I was cc’d on an email chain containing another member’s stay information and receipt. It was obviously a mistake and I informed them of this. I received a response from a Hyatt rep asking me to delete the email immediately, which I did. I’ll share more if I’m able to recover that deleted email. 

Outstanding questions

My main question about this leak is whether this was really just an email that was inadvertently shared or a case of specific people being targeted. Is it a coincidence that so far only bloggers seem to be affected? Was the information shared with the same four people or were these different people each time? Why was there such an urgency to speak with me on the phone only for it to be a very minor leak? 

Anyway, we probably won’t get more information beyond what’s been shared. If you received a similar call from Hyatt or have more info on this, please let me know in the comment section.