I am not surprised that this happened to Ctrip. Why I'm not surprised? Let me tell you something that happened to me:

I remember it was in 2011. I was on a business trip in Indonesia. When I returned home, I had to transit through Hong Kong and needed to stay for a day, so I called Book a hotel with Ctrip. In the end, everything was agreed upon. When it came to the payment process, Ctrip said it needed my credit card as a guarantee, and I said it was no problem. Is it abnormal to use a credit card as a guarantee? Right? So normal! Knot! fruit! The Ctrip operator started asking me in Chinese on the phone my credit card number, expiration date, CVV code and ID number! It was a real "ask", and then she asked me to read out the number, and she repeated it loudly to verify it. I collapsed at that time. Damn, did you just say this number casually? With these three things: credit card number, expiration date, and CVV code, I can just swipe my card online, okay? But there was no way, the hotel had to be booked. At that time, it was only convenient to book with Ctrip, and I didn’t know any other ways. After booking the hotel, I was so scared that I almost peed. After returning home, I immediately canceled the credit card and applied for a new one. This is not over yet. I complained to Ctrip later. The phone call lasted for almost an hour. Their manager obviously did not understand what I was talking about. First of all, I ask you if you are afraid that others will hear you read your card number. Then you can find a secluded place. (I couldn't stop vomiting blood) Then he swore to me that their operators would not steal my card information, saying that Ctrip operators were well trained. Damn it, you go to the bank to withdraw money, and then the bank asks you to tell your password because you trust its employees. Is this a fucking spy movie about passwords? I was very angry at the time, and I said that this is how it is going to be. One day I will apply for a job as an operator in your company. Once I start working, I will remember the credit card information of any customer. Then I couldn't make sense no matter how I tried to explain it, and it felt like they didn't think it was a problem. I was so angry that I hung up the phone. This is not over yet. Another year has passed, and I don’t have a long memory. I took the TOEFL exam in a different place and wanted to book a hotel through Ctrip. They asked me for my credit card information, but when I arrived at the CVV, I was asked to enter it on the keyboard. I felt relieved for a while, thinking that my complaint was finally useful. These idiots finally understood that this thing cannot be seen by others. Is it easy for me? Then I entered the CVV with joy in my heart and pressed the # sign, and then I heard the sweet voice of the operator, "Mr. Wang, the CVV you just entered is 123, right?". Ctrip doesn't just store CVV. It simply doesn't pay the slightest attention to this information that has great value and can cause heavy losses to customers. It's so normal for them to do something like this. It's so normal.