HEI Hotels Data Breach! CC Details Stolen by Hackers!
HEI Hotels have no need of introduction. It is a Norwalk (United States) based chain of hotels, which is controlling more than 50 hotels in United States. Few days ago, HEI revealed that they have found a malware in some of its POS (Point of Sales) systems. Payment Card Processor of HEI gave an alert that something is happening wrong. When the security team checked POS Systems, they found the malware.
Hyatt, Marriott, Starwood, Sheraton, Westin and many other hotels of HEI have been affected by this data breach. The malware was stealing Credit Cards details of customers, who made purchases on the POS systems of properties owned by HEI. In these properties, Restaurants, Lobby Shops, Bars and Spas are included. According to HEI, they don’t know the exact number of affected customers because a customer can swipe his card multiple times. But they have released a list of locations and dates, when malware hits the POS systems. In California, HEI have recorded more than 7500 transactions at Hyatt Centric Santa Barbara Hotel which had been done customers during affected period.
In Florida, approximately 13,000 transactions occurs in IHG Intercontinental Hotel during affected time period. The Malware was present in the POS (Point of Sales) systems of HEI from March 2015 to June 2016. The list of most affected hotels is as following:
HEI hired top security researchers to investigate this incident. According to researchers, this malware was stealing account numbers, Customer Names, Expiry Dates of Cards and Verification Codes. This malware was interacting with hackers through Command and Control Servers. The PIN codes of Credit Cards seems to be safe because POS Systems of HEI is not collecting the same.
If you have make any purchase at above locations during March 2015- June 2016, you could have been affected. HEI apologized from its customers for this incident. HEI advised its customers to have a look on Credit Card Statements of affected time period. If they notice any unusual transaction, they need to block their cards. HEI also said that, this incident taught us a great lesson. Now HEI is going to update its POS Systems to provide better security to payment card details of its customers.
Reasons Behind These Type of POS Attacks?
Hotels are using Third Party POS Systems, which anyone can buy. Hackers are finding vulnerabilities in these POS Systems and after that they are exploiting the databases of those hotels, which are using vulnerable POS Systems. Payment card companies are giving alerts to hotels and other organization to install proper security mitigations on POS Systems. A little mistake may lead the whole business to a huge risk.
Source: www.tripwire.com
