2016 InterContinental Hotels Breach Much Worse than Believed
In February, InterContinental Hotels Group (IHG) reported they had suffered a data breach between August and December, 2016 that affected 12 locations.
IHG, which is the parent company of Candlewood Suites, Crowne Plaza, Holiday Inn and Kimpton Hotels and Resorts, has now said in a statement the number is actually closer to 1,200. A full list of affected locations is available on their website.
The hotel chain first learned of the incident in late December and hired cybersecurity professionals to help them investigate the situation. They discovered that cybercriminals had installed malware on the hotels’ payment card processing servers, which allowed the hackers to steal credit card holder names, numbers and internal verification codes.
“The investigation identified signs of the operation of malware designed to access payment card data from cards used onsite at front desks at certain IHG-branded franchise hotel locations between September 29, 2016 and December 29, 2016. Although there is no evidence of unauthorized access to payment card data after December 29, 2016, confirmation that the malware was eradicated did not occur until the properties were investigated in February and March 2017,” the company said in a release.
To help eradicate the malware from franchised properties, IHG is offering them free computer forensic help and is asking all locations to install the Secure Payment Solution (SPS), which encrypts cardholder information.
For affected visitors, IHG is offering free credit monitoring software for a year.
This was the second data breach that struck IHG properties last year. In September, subsidiary Kimpton Hotels reported that malware had been installed on the payment terminals at over 60 of their locations.