Starwood, Marriott and Hyatt Breached (Again)

One can always tell that it is going to be a long week security story-wise when the Monday morning headlines start out with not one – but two – big breaches.

The more attention grabbing of the two will be the big hotels breach – according to reports out of Reuters, 20 U.S. hotels operated by HEI Hotels & Resorts for Starwood, Marriott, Hyatt and Intercontinental have apparently coughed up some payment card data.

And by some, we mean lots – specifically, the data from tends of thousands of food, drink and other transactions. This breach follows the form of previous hospitality breaches seen of late, particularly the one of Hyatt Hotels and Starwood Hotels & Resorts Worldwide.

Connecticut-based HEI attributes the stolen data to malware placed in their system. The bad code was first discovered in June, and was found to be primarily affecting payment systems used at restaurants, bars, spas and lobby shops.  The number of customers affected remains unknown – according to Chris Daly, a spokesman for HEI, there were tens of thousands of transactions, though many of those may have been from single customers using the same card multiple times per day.

All in all, 12 Starwood properties, 6 Marriott Properties and a single Hyatt hotel have been found to have been snagged in the breach. According to available data, the breach was active March 1, 2015 to June 21, 2016, with 14 of the hotels affected after Dec. 2, 2015, HEI said on its website on Friday.  IHG and Marriott have no comment on the breach at this point. According to HEI – customer names, account numbers, payment card expiration dates and verification codes are all likely to have been stolen.

Affected properties include: Starwood’s Westin hotels in Minneapolis; Pasadena, California; Philadelphia; Snowmass, Colorado; Washington, D.C.; and Fort Lauderdale, Florida. Also affected were Starwood properties in Arlington, Virginia; Manchester Village, Vermont; San Francisco; Miami; and Nashville, Tennessee.

The Marriott properties affected were in Boca Raton, Florida; Dallas-Fort Worth, Texas; Chicago; San Diego, California; and Minneapolis.