Sabre Corp., a hotel booking company, will pay $2.4 million to 27 states, including about $50,000 in Iowa, to settle a data breach it suffered in 2017 that went unreported to some of customers for a full year.
The Texas -based company and its subsidiary, Sabre Hospitality Solutions , use the SynXis Central Reservation system , which the company says is used by more than 40,000 hotels in 160 countries. In May 2017, the company notified federal authorities of a data breach that occurred from August 2016 to March 2017, in which consumer data , including about 1.3 million credit card numbers, was compromised.
Sabre notified hotel customers up to the hotels themselves to notify individual consumers, resulting in some receiving more than one notification and others not being notified of the breach until 2018.
“As we have seen in other data breaches, it is important that companies provide clear and timely notifications to their consumers so they can protect themselves from identity theft,” Iowa Attorney General Tom Miller said in a press release announcing the settlement.
In addition to the payments made to states, the settlement requires Sabre to clarify in future contracts the liability of all parties in case of a breach, to implement new security requirements and information security programs, and to undergo a security assessment by a third party.
For their part, consumers should be careful when choosing a website to make their online reservations. Also, when they have provided valuable information, they should be vigilant and frequently search their accounts on special sites, such as Have I Been Pwned, so that they can act immediately in such a case.
