“The chain that owns Starwood, Marriott, Hyatt, and Intercontinental hotels—HEI Hotels & Resorts—said this weekend that the payment systems for 20 of its locations had been infected with malware that may have been able to steal tens of thousands of credit card numbers and corresponding customer names, expiration dates, and verification codes. HEI claims that it did not lose control of any customer PINs, as they are not collected by the company’s systems.
Still, HEI noted on its website that it doesn’t store credit card details either. ‘We believe that the malware may have accessed payment card information in real-time as it was being inputted into our systems,’ the company said.
The breach appears to have hit 20 HEI Hotels, and in most cases, the malware appears to have been active from December 2, 2015 to June 21, 2016. In a few cases, hotels may have been affected as early as March 1, 2015. According to a statement on HEI’s website, the malware affected point-of-sale (POS) terminals at the affected properties, but online booking and other online transactions were not affected.
Although an HEI representative told Reuters that it’s still unclear how many customers were affected as some may have used credit cards multiple times, thousands and sometimes tens of thousands of transactions occurred at each property during the months before the malware was detected. The malware was able to scrape credit card details from hotel restaurants, spas, and lobby shops.
HEI noted on its website that it had contacted law enforcement and began ‘promptly transitioning payment card processing to a stand-alone system that is completely separated from the rest of our network.’ The hotel chain also recommended that recent customers check their credit and debit card transaction histories to guard against fraud.
Similar large-scale attacks have hit chain stores such as Target and Home Depot in recent years. Such high-profile hacks have encouraged retail industries in the US to phase magnetic stripe cards out in favor of chip-based credit and debit cards, although rollout of the new system has been spotty as vendors are slow to buy the new terminals to read the chip cards. Magnetic strip cards pass static credit card information to a company’s POS system, leaving that information susceptible to hackers who want to steal it to make duplicate credit cards. Chip-based transactions transmit a dynamic card number that makes it much more difficult to steal card numbers and use them for fraudulent purposes.”