Let’s play the fun-filled gameshow “This Week’s Breaches!”
If you guessed Kimpton Hotels, you’re a winner. If you guessed Dropbox, well, we’ll give you extra credit and a copy of “This Week’s Breaches: The Home Game!” This week brings news of breaches affecting some 60 Kimpton Hotel properties along with a big breach at Dropbox, albeit four years ago (!) but only being widely reported this week, with an estimated 68 million user accounts affected.
In the Kimpton case, the company announced Wednesday that Point of Sale (POS) systems in some of their properties had been infiltrated, with the hotel chain warning customers that had used credit cards at the specific Kimpton sites from February 16th to July 7th of this year that their data may very well have been compromised.
John Peterson, VP and GM of Comodo Enterprise, urged industry professionals, particularly hospitality IT professionals, to be more proactive about cybersecurity.
“Hospitality companies need to do everything they can to protect their customers’ data; this means deploying the latest developments in endpoint protection and secure web gateways that actually prevent breaches through the most advanced methods available to the industry today. When it comes to hotel breaches, customers need to be aware of their exposure. They should keep a close eye on accounts that may be impacted and report any suspicious behavior on those accounts,” Peterson said.
POS systems are particularly vulnerable, and particularly attractive to cybercriminals, who typically take the plundered information and transfer it to the magnetic stripes of bogus cards.
In its advisory, Kimpton stated, “The malware searched for track data read from the magnetic stripe of a payment card as it was being routed through the affected server. The malware primarily found track data that contained the card number, expiration date, and internal verification code, but in a small number of instances it may have found the track that also contains the cardholder name.”
A list of Kimpton properties that were affected, as well as the full advisory, are posted on the company’s website.
While the Dropbox breach is in a different category – the breach involved the theft of user emails in 2012, which were only recently leaked to the Internet – which leads to a tangential debate for another time about which breaches are reported and which ones aren’t, and why – the end result is the same: in both cases, consumer information has been compromised and the reputation of a major company has been sullied. Another commonality the two incidents share is that both of these breaches could have been prevented, as frankly these types of cybercrimes are entirely preventable, by installing the right protection from the beginning.
Perhaps in Dropbox’s case, the security safeguards weren’t as readily available four years ago…but now there are certainly solutions, preventative medicine, as it were, readily available for companies to take advantage of. Once again, as if there haven’t been enough warnings already, corporate America, for the good of your guests, your customers, your brand and your bottom line, please pay attention! Hospitality industry professionals, retail professionals, and businesses large and small all need to heed John Peterson’s warning and take proactive steps to ensure that their company is not featured on next week’s exciting episode of “This Week’s Breaches!”
