Intercontinental Hotels Group confirms second credit card breach

Malware skimmed customer data from systems

Hotel

Intercontinental Hotels Group (IHG) has suffered a second breach of its payment card systems, the company admitted. 

It said in a notification that the breach happened in some hotels between 29 September and 29 December 2016. It said it had hired a cyber security firm to investigate the breach, which "identified signs of the operation of malware designed to access payment card data from cards" used on site at front desks at certain hotels.

It added that there was no evidence of payment card data being accessed after 29 December, but cautioned that it couldn't confirm the eradication of the malware until investigations began in February and March of this year.

The hotel chain said the malware searched for track data (which sometimes has cardholder name in addition to card number, expiration date, and internal verification code) read from the magnetic strip of a payment card as it was being routed through the affected hotel server. "There is no indication that other guest information was affected," it said in a statement.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The hotel chain had suffered a breach earlier in the year. This breach not only affected its hotels but also bars and restaurants at hotels, such as the Knob Hill Club and Michael Jordan's Steak House and Bar at Intercontinental Chicago. 

It also published a list of affected operations and times they were breached in a separate web page. The list features over a thousand hotels affected by the malware.

The chain has now deployed point-to-point encryption payment in a bid to prevent malware from searching systems for card data. The hotel affected by the breach had not previously implemented this security measure.

In addition, a subsidiary of Intercontinental Hotels, Kimpton Hotels, is fighting a class action lawsuit over allegations that the chain failed to adequately protect guests' payment card data and other personal information.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/microsoft-windows/354789/microsoft-pulls-disastrous-windows-10-security-update
Microsoft Windows

Microsoft pulls disastrous Windows 10 security update

17 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/cloud/cloud-computing/354767/google-cloud-snaps-up-multi-cloud-analytics-platform-for-26bn
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020