Hackers broke into a computer at Wyndham Hotels and Resorts last July and stole tens of thousands of customer credit card numbers, the hotel chain has warned.
The break-in occurred at a property belonging to a Wyndham franchisee, but that computer was linked to other company systems.
“That intrusion enabled a hacker to use the company server to search for customer information located at other franchised and managed property sites,” the company said in a statement disclosing the breach.
The data was then uploaded to a Web site during July and August of 2008, Wyndham said. The company estimates that 41 Wyndham hotels and resorts were affected by the breach before it was discovered by the company’s information security team in mid-September. The incident did not affect other Wyndham properties, such as Days Inn, Ramada or Super 8.
Wyndham has not said how many guests were affected by the theft, but it may have affected as many as 21,000 customers in Florida, according to the state’s attorney general. Wyndham representatives did not return calls seeking comment on the breach.
The criminals were able to get guest names, credit card numbers and their expiration dates, as well as data from the cards’ magnetic stripe, Wyndham said.
CVV codes – hot info
Magnetic stripe information, sometimes called a card verification value (CVV) code, is critical if the thieves want to make fake credit cards, according to Avivah Litan, an analyst at Gartner Inc.
“That’s the hot information,” she said. “You can sell that information for much more on the black market.” CVV codes were also taken in the high-profile Heartland Payment Systems Inc. and The TJX Companies Inc. credit card thefts.
When fraud is perpetrated using fake cards that include the CVV codes, the banks are responsible for the charges; when the fraudsters have only the card numbers and expiration dates — the information used in online transactions, for example — then the retailer is responsible for the charges. “The banking industry is all up in arms whenever bank stripe data is stolen,” Litan said.
After an eight-week investigation, Wyndham notified credit card companies and the U.S. Secret Service, which investigates financial crimes. Customers were made aware of the breach in December. Last week, it posted more details about the incident on its Web site.
Big time breaches
The Wyndham data breach is the latest in a bunch of high-profile hacking attacks – in which cyber criminals have managed to steal vital credit card data.
In many of these cases, definite information on the number of people affected by the break in has not been available.
However, the breach disclosed last month involving Heartland Payment Systems – in which more than 100 million cards were potentially compromised – is believed to be the largest ever involving payment data, – displacing even the notorious TJX Companies’ January 2007 breach.
In that case, unknown intruders had broken into its systems sometime last year and planted malicious software to steal card data carried on the company’s networks.
Heartland, the N.J.-based provider of credit and debit card processing services said claimed to have discovered the intrusion after being alerted by Visa and MasterCard of suspicious activity.
The company said the intrusion may have been the result of a “widespread global cyberfraud operation”.
As with most data breach notifications, Heartland offered no explanations on when it was first informed of the breach by the card companies, when in 2008 the company had been breached, how long the intruders had remained undetected, or how many cards might have been compromised in the intrusion.
Given that Heartland processes more than 100 million card transactions per month, it is very possible that the number of compromised credit and debit cards is at least that much, if not more, said Avivah Litan, an analyst with Gartner Inc.
“It does look like the biggest ever,” Litan said. The TJX breach involved the compromise of over 45 million cards.
It also appears that those behind the breach “made off with the gold” by intercepting and stealing the so-called Track 2 data from the magnetic stripe on the back of cards, which is all that’s needed to create counterfeit cards, Litan said.
Dan Clements, president of CardCops, an identity protection service of Affinion Group Inc., said that he has noticed activity in underground chat rooms that suggested a major compromise at a processor such as Heartland.
Typically when a card is stolen, crooks first check to see if the cards are still active by using it for some transaction — often a very small donation to a charitable organization – to see if it works.
This sort of validity check has increased by nearly 20 per cent over the past few months, suggesting a major compromise. But it’s not clear yet if it is related to the Heartland breach, Clements said.
Another major breach that recently came to light involved RBS WorldPay, the payment processing division of The Royal Bank of Scotland Group.
One Dec. 23, RBS announced its systems had been breached by unknown intruders, resulting in the compromise of personal information belonging to about 1.5 million card holders.
The compromised information included the Social Security numbers of 1.1 million individuals using payroll cards, the company said.
The incidents suggest that cybercrooks are increasingly beginning to target payment processors, Litan said. “Attacking a processor is much more serious than attacking a retailer.
A processor sits at the nerve center of the payment process,” and processes far more payment card data than any retailer, she said.
“More radical security moves” need to be taken by payments industry as a whole to address the problem, she added.
Such incidents show that the security requirements of the Payment Card Industry
Data Security Standard (PCI DSS) being pushed by the major card companies is clearly not enough, Litan added.
Source: Computerworld.com