Trump Hotels Infected.
In an announcement on the chain's website, the Trump Hotel Collection informed its customers that their credit card data may have been stolen through malware installed on its payment systems. The malware apparently was active at a number of Trump hotels for over a year.
The breach, first reported by security reporter Brian Krebs in June, affected seven hotels and resorts in the chain, according to a Trump Hotel spokesperson. But the company's executives claim that they have found 'no forensic evidence' that credit card data was actually stolen, despite the fact that several banks have claimed a pattern of fraudulent charges stemming from transactions at the hotels.
'Between May 19, 2014, and June 2, 2015, we believe that there may have been unauthorized malware access to some of the computers that host our front desk terminals and payment card terminals in our restaurants, gift shops and other point-of-sale purchase locations at some hotels managed by the Trump Hotel Collection,' a company spokesperson wrote in a statement on the Trump Hotel website. 'For those customers that used credit or debit cards to make purchases during this time, we believe that the malware may have affected payment card data including payment card account number, card expiration date and security code.' At the Trump hotels in Las Vegas and Waikiki, the data may have also included customers' first and last names.
However, the chain claimed that an independent forensic investigation of its computer systems 'did not find any evidence that any customer information was removed from our systems.' Trump Hotel Collection is offering 'one year of complimentary identity protection services through Experian' to customers who may have been affected, but this is merely out of caution, the company spokesperson said.
Trump's hotels were among a number of high-profile, luxury hotels hit by credit card breaches this year. Mandarin Oriental Hotels disclosed a breach in March, and the White Lodging hotel management company announced in April that it had suffered its second breach in two years—one that affected the same systems that had been previously breached in some cases.
The type of malware used in the attack on Trump captures credit card swipe data at a point-of-sale system. The systems attacked were pin gift shops, restaurants, and front desk terminals with credit card scanners. These types of attacks are why credit card issuers are pressing for retailers to adopt EMV chip-based point-of-sale systems, which use cryptography on the card's chip to create a one-time confirmation code for each transaction. That data is passed directly to the financial institution that issued the card and isn't retained by the retailer.
While effective in some contexts, this system doesn't protect against fraud in transactions where the card data is read by traditional means (a magnetic swipe) or when the card is not present (given over the phone, for example).
Back to Blog
Read Original Article