Hackers claim Tez Tour breach, 395 million records deleted
This digest was compiled by AI from multiple sources — links to the originals are below.
The DataSuckers hacking group claimed on September 15 to have breached tour operator Tez Tour, deleting more than 395 million records including 252 million financial transactions. Tez Tour confirmed the breach to Interfax but said no data leak has been detected and current bookings remain valid. The company's main website and Belarusian version are currently unavailable.
Key Facts
- DataSuckers claimed to have deleted more than 395 million records, including 45.4 million booking records, 21.5 million tour orders, 52 million hotel bookings, and 252 million financial transactions.
- Tez Tour commercial director Voskan Arzumanov told Interfax that the incident affected the website but no signs of data leakage have been found.
- The hackers said they gained initial access about two weeks earlier through a file upload service that allowed execution of PHP code inside a Docker container.
- Tez Tour's main website and the version for Belarusian customers are currently unavailable.
- In June 2026, tour operator Fun&Sun experienced a 'technical anomaly' that left travelers without necessary documents for over a month.
The Breach
The DataSuckers group announced the breach on September 15, posting a message on Tez Tour's homepage claiming server takeover and data compromise. The hackers stated they had access to the infrastructure for about two weeks and gradually expanded their privileges. According to DataSuckers, the entry point was Tez Tour's file upload service, which allowed a file to be processed as PHP code. This enabled command execution inside a Docker container, from which the attackers reached the company's internal network. The attackers then found credentials for SVN repositories containing source code and database passwords, and used Tomcat Manager to execute code in production.
Company Response
Tez Tour confirmed the breach to Interfax, but commercial director Voskan Arzumanov described the consequences differently. Arzumanov said the incident affected the website's operation, but no signs of data leakage have been detected. He stated that current bookings are preserved and obligations to clients are being fulfilled as usual. The company said it took necessary measures to localize the incident and protect information systems immediately after detecting unauthorized activity. Tez Tour also said its ERP system was isolated in a timely manner and was not affected.
Industry Context
In June 2026, tour operator Fun&Sun experienced a 'technical anomaly' in its infrastructure. Travelers who had paid for tours could not obtain necessary documents, including flight itinerary receipts, insurance, and hotel vouchers. Fun&Sun's website and mobile app were unavailable for more than a month, with access restored only by the end of July.
4 sources
Time · lag behind first