How one vulnerable service can expose an entire company

It may have started with an ordinary file upload

According to information published by the attackers, a file upload service may have been the initial entry point.

At first glance, this is a routine feature: a user attaches a document, image or other file, and the server receives and stores it.

Yet features like this require particularly careful protection.

If the server does not adequately validate an uploaded file’s contents, an attacker may try to submit a specially crafted object and cause their own code to execute.

From there, the attack can develop inside the infrastructure.

DataSuckers claimed that after gaining initial access, the attackers found configuration files and credentials that helped them reach other systems.

This is where the central lesson emerges.

A compromise rarely ends where it begins.

One foothold can open a path to dozens of systems

A modern company’s IT infrastructure rarely consists of a single server.

It typically connects:

• the website;
• CRM;
• ERP;
• databases;
• payment services;
• internal APIs;
• booking systems;
• file storage;
• administration panels;
• analytics services;
• backups.

Once an attacker reaches one component, the website itself is no longer their only objective.

The next goal is to expand privileges and move deeper.

DataSuckers said it maintained access to Tez Tour’s infrastructure for around two weeks, gradually expanding its capabilities within the network.

This is known as lateral movement: moving between systems within the infrastructure.

That is why website security cannot be considered separately from the security of the whole system.

What happened to the data?

The attackers made extensive claims.

The group claimed access to hundreds of millions of records, allegedly including bookings, orders, hotel information and financial transactions.

The attackers also claimed to have obtained passport details, phone numbers, addresses and banking information.

It is important, however, to distinguish attacker claims from confirmed facts.

At the time of publication, Tez Tour said it had found no evidence of a data leak. It also stated that its ERP system had been isolated and was unaffected, and that existing bookings remained intact.

It would therefore be inaccurate to present the full claimed volume of stolen data as confirmed.

The most concerning part: backups

There is another point of particular importance to businesses.

The attackers said backups were stored on the same servers as the primary systems.

If true, that creates a serious problem.

Imagine this arrangement:

Primary database → backup → one server → one set of access rights

In this architecture, the backup no longer provides independent protection.

An attacker with sufficient server privileges may also be able to affect the backup.

A backup should protect the business even when the primary infrastructure has been fully compromised.

That requires separate storage, restricted access, different privilege levels and a way to restore systems independently of the compromised infrastructure.

Why patching the initial vulnerability is not enough

After detecting an attack, a company usually disconnects the suspicious service, blocks access and begins investigating.

But if an attacker has already spent time inside, closing the original vulnerability is not sufficient.

You need to establish:

Which accounts were compromised?

Which keys and passwords may have been exposed?

Where did the attacker move?

Which servers were affected?

Do any additional entry points remain?

Can the existing backups be trusted?

This is why recovery after a serious incident can take far longer than fixing the original vulnerability.

What does this mean for an ordinary business?

You do not need to be a major tour operator to face this kind of problem.

A small business may also have:

• a customer database;
• CRM;
• online payments;
• customer accounts;
• APIs;
• a file server;
• an admin panel;
• integrations with other services.

The more systems are connected, the more important it becomes to control the connections as well as the individual components.

A basic security checklist for businesses

The central lesson

The Tez Tour incident is about more than a single hacked website.

It illustrates how one entry point can potentially lead to a much larger attack.

When building an IT system, it is not enough to ask:

‘Is our website secure?’

An even more useful question is:

‘What happens if our website is compromised anyway?’

If the company can still restore data, isolate systems and quickly revoke compromised access, its infrastructure is genuinely prepared for an incident.

If everything depends on one server, one set of passwords and a backup beside the primary database, the problem begins long before the attack.