Hotels Hit With Nine-Month Long Data Breach

First there was Target. Then, last week, we reported on the 1.1 million Neiman Marcus customers whose information was stolen in a security breach. Now, White Lodging Services Corp has revealed that card data from fifteen hotels spanning eight states has been breached over a nine-month period.

Federal authorities have been notified of the suspected breach, and a review of all managed properties was underway, the company said.

According to the hotel management company, customers’ names, credit or debit card numbers, three-digit security codes and card expiration dates were all breached between March 20 and December 16, 2013, in hotels operated by Marriott, Holiday Inn, Westin, Renaissance and Radisson. As in similar large-scale breaches, the information was stolen at point-of-sale – in this case, food outlets in the hotels.

Customers who checked into rooms at fourteen of the hotels, rather than using cards to purchase food and drink, appear not to have been affected, although the front desk of one hotel, operated by Radisson in Indiana, was also subject to the breach. According to a company press release issued on February 3, 2014, the following hotels’ food and beverage outlets may have been breached:

While White Lodgings has not put a number on the amount of customers involved, cybersecurity firm Krebs on Security suggested that thousands of accounts were likely compromised, Reuters reported. The management company handles 169 hotels nationwide. Federal authorities have been notified of the suspected breach, and a review of all managed properties was underway, the company said.

White Lodgings has now issued the following advice to customers who may be affected:

Congress has held several hearings in recent weeks aimed at addressing security concerns, and news of further breaches will only add to the sense that current legislation is ineffective and fails to protect consumers. In previous years, bills seeking tighter data protection have languished while failing to find enough cross-party support to move forward – but, perhaps with the recent attention paid to just how secure card transactions really are, the government will be able to move forward and provide the U.S. public with the security they want.

For the fifteen hotels hit by the latest breach, it’s too late – but for countless other businesses, there’s still a huge amount to play for, and a lot of work to do to regain customer trust.