There are at least three common vulnerabilities on the website: Forced Browsing, Account Harvesting, that allows enumeration of possible valid PIN values. These three have been on the Top 10 list of web application vulnerabilities for well over a decade, and should have been discovered in any security assessment in minutes. Until the company proves that it takes security seriously, Honors users should be wary of potential manipulation of their account data, as well as of the risk of identity theft based on the information in their profile.”]
Source: https://informationsecuritybuzz.com/articles/comments-on-hilton-honors-accounts-hijacked/