In December, InterContinental Hotels Group (IHG) reported that it was investigating a possible data breach at some of their brands between September 29, 2016 and December 29, 2016. At the time, specific details were not available. However, they have now issued a statement with some additional information on the breach as well as offered a tool to help customers search for affected locations at which they may have visited during that timeframe.
The locations include many, but not all Holiday Inn, Holiday Inn Express, Holiday Inn Resort, Hotel Indigo, Candlewood Suites, and Staybridge Suites locations in the United States, Puerto Rico, and Canada. The company has not made it easy to determine exact information as far as the numbers, but there is a state-by-state lookup tool provided at the IHG website under the link call “Payment Card Notification.” A rough review using the tool estimates well over 1,150 affected properties. The highest numbers were at Holiday Inn Express locations.
Since many of the IHG properties are franchised, some did not take IHG up on the offer to investigate. Therefore, it is not known if others are affected. It’s a good idea to be diligent at checking payment card details of anyone using cards at any IHG property during that time frame. Check statements as often as is reasonable and notify the card issuer immediately if fraud is suspected. Do this for at least the next 12 months or until that card is no longer valid.
The statement by IHG claims that malware was found that is designed to access payment card information from cards used at the front desks of the locations. The information accessed was read from the magnetic strip and may have included names along with card numbers, expiration dates, and the CVV code.
Other hotel chains that have been hit with Point of Sale (POS) malware recently include, HEI Hotels, which runs many Omni, Marriott, and Hyatt locations as well a, Hilton, Starwood, and Trump Hotels.
The investigation continues with help from a leading cybersecurity firm. However although the breach occurred late last year, eradication of the malware was not confirmed until the investigations in February and March of 2017. Remember that since not all properties are taking advantage of the investigative services offered by IHG, it may never be known if some locations were part of this. So don’t assume that if a location you visited isn’t listed in the tool that it wasn’t affected.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
