Sources at multiple financial institutions say they have detected a pattern of fraudulent activity involving customer cards used at Hilton hotel properties from mid-April through late July 2015.
The apparent breach, the numbers affected are not yet known, involves the Hilton and the Embassy Suites, Doubletree, Hampton Inn & Suites, and the upscale Waldorf Astoria Hotels & Resorts brands across the United States.
Independent security researcher Brian Krebs, who reported the situation, said Visa initially took part in the fraud and after further investigation with five different banks, it was determined that the common factor in all the transactions was Hilton (and related properties).
For its part, Hilton has issued a statement to the media:
“Hilton Worldwide is committed to protecting our customers’ credit card information,” the company said. “We have multiple systems in place and work with some of the most leading experts in the field to address data security. Unfortunately, the potential for fraudulent credit card activity is all too common for any company in today’s marketplace. We take any potential issue very seriously and are investigating it carefully.”
It appears that the guest reservation system was not compromised. Rather, the fraud originated from hacked point-of-sale devices inside franchised restaurants, coffee bars, and gift shops within Hilton properties.
“ Hackers use different attack vectors to exploit businesses, and many recent breaches have involved malware that, once installed, extracts sensitive data,” said security expert Kevin Watson, CEO of Netsurion, a Houston-based security firm, in an email. “There is no perfect strategy to protect against every threat. However, a strong line of defense ensures that data does not leave the network without the administrator’s knowledge, and if data is sent outside, it only goes to verified addresses on the Internet.”
Mr. Watson advised: “Security should be layered with a properly managed firewall, data encryption, network segmentation, passwords and access controls, software updates, and anti-virus/anti-malware software.” “In addition to protecting inbound traffic and preventing malicious actors from accessing it, it is also critical to limit outbound Internet traffic.”
This is the latest in a string of hotel robberies, including break-ins at the Mandarin Oriental, Hard Rock Las Vegas and others.
