Maximise your Avios, air miles and hotel points

HACKED: IHG admits it has been under an ongoing cyber attack since Sunday

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

The IHG website was down on Sunday evening and all of Monday, and even now as I write is not actually functional.

It was passed off as maintenance, but it is now clear that IHG has been the victim of a major hacking attack.

Whilst IHG has not sent any information to IHG One Rewards members, it has been required to put out a statement for regulatory reasons.

IHG hotel hack

IHG said during Tuesday:

InterContinental Hotels Group PLC (IHG or the Company) reports that parts of the Company’s technology systems have been subject to unauthorised activity. IHG’s booking channels and other applications have been significantly disrupted since yesterday, and this is ongoing.

IHG has implemented its response plans, is notifying relevant regulatory authorities and is working closely with its technology suppliers. External specialists have also been engaged to investigate the incident.

IHG is working to fully restore all systems as soon as possible and to assess the nature, extent and impact of the incident. We will be supporting hotel owners and operators as part of our response to the ongoing service disruption. IHG’s hotels are still able to operate and to take reservations directly.

A further update will be provided as and when appropriate.

The original statement is here.

As of Tuesday evening, when I am typing this, the website is up but not functional. A message at the top of the page says:

A message to our guests: At this time, you may have challenges booking a new reservation, accessing information about your upcoming reservations and accessing your IHG One Rewards account.  We’re working to restore all service as soon as possible. If you have an urgent request for an upcoming stay or need to make an urgent reservation, you can call the hotel directly to make, amend or cancel a booking. Thank you for your patience.

This is, clearly, a major issue for IHG. Hotels have lost 2-3 days of bookings, with perhaps more to come. There will undoubtedly be members who could not cancel reservations and will face penalties. It also appears that hotels cannot see the status level of arriving guests.

By the time you read this on Wednesday functionality may be restored. We now need to see what has been stolen in terms of credit card data, passport data, email addresses etc. If any sensitive data has been taken, the legal settlement in the EU alone is likely to be £100 million to £200 million, given pre-pandemic settlements made by British Airways and Marriott for similar breaches.


IHG One Rewards news

IHG One Rewards update – April 2025:

Get bonus points: IHG is not currently running a global promotion.

New to IHG One Rewards?  Read our overview of IHG One Rewards here and our article on points expiry rules here. Our article on ‘What are IHG One Rewards points worth?’ is here.

Buy points: If you need additional IHG One Rewards points, you can buy them here.

Want to earn more hotel points?  Click here to see our complete list of promotions from IHG and the other major hotel chains or use the ‘Hotel Offers’ link in the menu bar at the top of the page.

Comments (75)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Phillip says:

    Accessing account details etc seems fine now. New hotel searches error out so currently unable to make a new reservation. Existing reservations are showing okay.

  • Novice says:

    App is not showing hotels etc for me if searched

  • Ian says:

    Probably why I couldn’t sign up for the Ambassador membership yesterday.

  • Nick says:

    The desktop site appears to be working OK. I can view my One Reward account and current reservations, and search. Not sure about actual booking, as I don’t have anything to book now, but I got to the payment page.

    I can’t search on the app though (eg. it doesn’t recognise London as a destination!).

    • BJ says:

      Not even in Ontario, Canada?

    • Mark Peterborough says:

      The app on Android won’t find any hotels in London for me either . The nearest ones that it will find are in Hemel Hempstead and Gatwick . The app was behaving like this when I checked on Saturday as well .

  • Brian78 says:

    Hackers are quite sophisticated with their methods but this is probably another example of a company leaving the back door open.

  • Dave says:

    Perhaps IHG will reintroduce the popular pointsbreaks promotion to both compensate IHG members and to quickly increase bookings.

    • Rob says:

      I was never too convinced that many people did want a 5,000 point redemption in a Holiday Inn Express in Doncaster, to be honest. I never booked a single PointsBreak.

      • David says:

        Did well over 100 nights on PB myself. IC Düsseldorf was a very nice one and miles from Doncaster in very way.

      • John says:

        I rebooked many crappy small town HIXs from £50 ish to 5000 points

        Never found a nice hotel that I had another reason to go to though

    • Alex Sm says:

      There was already a very generous points booking deal or even a couple of these recently – covered by HfP.

      • Dave says:

        Didn’t see any at 5000 points though!

        Pointsbreaks were very popular and fun, creating excitement each time the latest hotels were announced. There was always some good deals. I got Liverpool waterfront for 5k.

  • Patrick C says:

    While there is certainly under-investment in IT security, I think we need to get towards a stage where we take these incidents a lot more seriously.
    Meaning as a society. That will mean actively looking to investigate and counterattack states that sponsor such activities. And yes it is always the same ones really.
    Also unless the pain threshold for these states rises significantly it will go on and get worse. This implies tearing up some international principles (but plenty of those are currently being swept the way) on global internet access.
    Anyway hopefully not too much personal data has been leaked around.

    • Brian78 says:

      Do you mean placing sanctions on these countries?

    • Rob says:

      It’s really not difficult. You should see the IT security warnings we receive. IHG didn’t code its own website, no-one does these days – they just took lots of bits of third-party code and threw them together, same as HfP. All of these elements can include vulnerabilities. Any points where data is imported into the site (from downloading ads, uploading comments, pulling in price data from 3rd parties) makes you vulnerable to an injection of compromised code. This is before you get to the admin staff who use passw0rd as their password …

      • Colin MacKinnon says:

        How did you know my password – I’d only just changed it from my cat’s name!

    • Aston100 says:

      Goodluck counterattacking Russia and China.

    • Will says:

      I’m hoping they’re working on it in the background but it’s time to draw a line and simply not trade at all with authoritarian run countries.

      Even if the leader today is reasonable, tomorrow they may not be and I know that’s an invitation for a “but Trump, but Boris” comment, but really take a step back for a moment and compare them to sterilising Muslims in China or invading Ukraine or chopping a vocal journalist into pieces in your embassy.

      And all the while we buy things from these places while they pump pollution into the environment as they simply ignore and efforts to curb it.

      But cheap iPhones yeah?

  • dahokolomoki says:

    Bookings now work. Interesting, found a sale rate called Great Getaway. Flexible rate. 50% off BAR. For the Kimpton South Beach for 24th Dec to 28th Dec, usd310 vs usd450+ the next cheapest rate.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.