Data Breach At 20 Hotels In 10 States May Have Exposed Guests’ Payment Card Data

The operator of several hotels across 10 states and Washington, D.C. — including Starwood, Marriott, Hyatt and Intercontinental locations — says guests may have had their payment data exposed by hackers who targeted the businesses with malware starting last year.

HEI Hotels & Resorts says malware as discovered in early to mid-June on payment systems used at restaurants, bars, spas, lobby shops, and other facilities at the properties, a spokesman told Reuters. Included on the list of affected locations are 12 Starwood hotels, six Marriott International properties, one Hyatt hotel and one InterContinental Hotels Group location

As for how many people could have been affected, it’s unclear because some guests may have used their cards more than once. Around 8,000 transactions were processed during the affected period at the Hyatt Centric Barbara Hotel in California, for example, while 12,800 were processed at an IHG hotel in Tampa.

HEI says experts investigated the breach and found that the hackers may have taken names, account numbers, payment card expiration dates, and verification codes, though it doesn’t appear the attackers culled PINs. The company says it’s transitioned payment card processing to a standalone system that’s separated from the rest of its computer network, disabled the malware, and reconfigured its point-of-sale and payment card processing systems “to enhance the security of these systems and to help prevent this type of incident from happening again in the future.”

The company has also alerted law enforcement and says it will fully cooperate with the ongoing investigation.

“We are pleased to report that the incident has now been contained and individuals can safely use payment cards at all of our properties,” HEI said on its website.

For a list of affected hotels, click here.

This latest attack follows payment card data breach earlier this summer that may have affected multiple Kimpton Hotels locations.