In February 2015, KrebsOnSecurity reported that for the second time in a year, multiple financial institutions were complaining of fraud on customer credit and debit cards that were all recently used at a string of hotel properties run by hotel franchise firm White Lodging Services Corporation.
The company said at the time that it had no evidence of a new breach, but last week White Lodging finally acknowledged a “suspected” breach of point-of-sale systems at 10 locations.
Banking sources back in February 2015 told this author that the cards compromised in this most recent incident looked like they were stolen from many of the same White Lodging locations implicated in the 2014 breach, including hotels in Austin, Texas, Bedford Park, Ill., Denver, Indianapolis, and Louisville, Kentucky.
Those sources said the compromises appear once again to be tied to hacked cash registers at food and beverage establishments within the White Lodging run hotels. The sources said the fraudulent card charges that stemmed from the breach ranged from mid-September 2014 to January 2015.
In a press release (below) issued April 8, 2015, White Lodging announced the “suspected breach ofpoint of sales systems at food and beverage outlets, such as restaurants and lounges, from the period July 3, 2014 through February 6, 2015 at 10 properties.
While it acknowledged some of the locations breached this time around were the same as last year’s victim locations, the company emphasized that this was a separate breach.
“After suffering a malware incident in 2014, we took various actions to prevent a recurrence, including engaging a third party security firm to provide security technology and managed services,” wrote Dave Sibley, White Lodging president and CEO, Hospitality Management. “These security measures were unable to stop the current malware occurrence on point of sale systems at food and beverage outlets in 10 hotels that we manage. We continue to remain committed to investing in the measures necessary to protect the personal information entrusted to us by our valuable guests. We deeply regret and apologize for this situation.”
White Lodging said the stolen data includes names printed on customers’ credit or debit cards, credit or debit card numbers, and the security code and card expiration dates. Naturally, White Lodging is offering a year’s worth of credit protection services for customers impacted by the breach, from Experian.
Brian Krebs worked as a reporter for The Washington Post from 1995 to 2009, authoring more than 1,300 blog posts for the Security Fix blog, as well as hundreds of stories for washingtonpost.com and The Washington Post newspaper, including eight front-page stories in the dead-tree edition and a Post Magazine cover piece on botnet operators. He was recently profiled in Business Week and by Poynter.org.
www.krebsonsecurity.com
White Lodging releases information about data breach investigation at select food and beverage outlets
Officials of White Lodging Services Corporation, an independent hotel management company, announce the suspected breach of point of sales systems at food and beverage outlets, such as restaurants and lounges, from the period July 3, 2014 through February 6, 2015 at 10 properties. Systems other than the point of sales systems at the food and beverage outlets are not believed to be affected.
The food and beverage outlets affected are located at:
- Indianapolis Marriott Downtown, Indianapolis, IN
- Chicago Marriott Midway Airport, Chicago, IL
- Auburn Hills Marriott Pontiac at Centerpoint, Pontiac, MI
- Austin Marriott South Airport, Austin, TX
- Boulder Marriott, Boulder, CO
- Denver Marriott South at Park Meadows, Denver, CO
- Louisville Marriott Downtown, Louisville, KY
- Renaissance Boulder Flatiron, Broomfield, CO
- Courtyard Austin Downtown, Austin, TX
- Sheraton Hotel Erie Bayfront, Erie, PA
White Lodging manages hotels under agreements with the hotel owners and is a distinct and separate entity from specific hotel brands.
Guests at the hotels who did not use their credit card at these outlets, and guests who charged to their room account at these outlets, are not believed to be affected.
"After suffering a malware incident in 2014, we took various actions to prevent a recurrence, including engaging a third party security firm to provide security technology and managed services," said Dave Sibley, White Lodging president and CEO, Hospitality Management. "These security measures were unable to stop the current malware occurrence on point of sale systems at food and beverage outlets in 10 hotels that we manage. We continue to remain committed to investing in the measures necessary to protect the personal information entrusted to us by our valuable guests. We deeply regret and apologize for this situation."
Upon learning of the suspected data security breach, company officials immediately contacted appropriate federal law enforcement officials and initiated a third-party forensic review. The company continues to work with investigators and the credit card companies.
The unlawfully accessed data at risk is believed to be limited to names printed on customers' credit or debit cards, credit or debit card numbers, the security code and card expiration dates. Guests who used or visited the affected food and beverage outlets during the seven month-period and who used a credit or debit card to pay their bills at the outlets might have had such information compromised and are encouraged to review their statements from that time period.
We are offering one year of complimentary fraud resolution and identity protection services, to all affected cardholders. Enrollment information and additional information are on our website (/www.whitelodging.com/about/payment-card-issues).
Potentially impacted guests should also consider placing a fraud alert on their credit files. An initial fraud alert, which lasts for 90 days, requires potential creditors to use reasonable policies and procedures to verify a customer's identity before issuing credit in his/her name. To place an alert, calls can be made to anyone of the following three credit reporting agencies: Experian (888) 397-3742; Equifax (800) 525-6285; or TransUnion (800) 680-7289. A fraud alert request call to any of the three agencies will result in all three agencies implementing the alert. Customers then will receive communications from all three agencies, confirming that the alert is in place and letting customers know how to obtain a free copy of your credit report. Interested parties also can order a free copy of his/her credit report by calling (877) 322-8228 or by visiting www.annualcreditreport.com.
Brian Krebs worked as a reporter for The Washington Post from 1995 to 2009, authoring more than 1,300 blog posts for the Security Fix blog, as well as hundreds of stories for washingtonpost.com and The Washington Post newspaper, including eight front-page stories in the dead-tree edition and a Post Magazine cover piece on botnet operators. He was recently profiled in Business Week and by Poynter.org.
www.krebsonsecurity.com
