Credit Card-Grabbing Malware Hits Hyatt Hotels Once Again

The Hyatt hotel chain was again riddled with credit card-stealing malware in an “operation” between March 18 and July 2^, 2017. While only 41 hotels have reportedly been affected this time, compared to 250 in 2016, most infected locations are in China and elsewhere in Asia.

The hotel seems unable to tell just what type of data was actually collected, apart from cardholder names, card numbers, expiration dates and verification codes. Hyatt has also provided a full list of affected hotels, which is available here.

“Upon discovery, we launched a comprehensive investigation to understand what happened and how this occurred, including engaging leading third-party experts, payment card networks and authorities,” reads the statement from Chuck Floyd, global president of operations. “Based on our investigation, we understand that such unauthorized access to card data was caused by an insertion of malicious software code from a third party onto certain hotel IT systems,”

The infection allegedly occurred after third-party software was installed on hotel equipment, allowing threat actors to quietly siphon credit card data. While there is no mention of the type of malware used or how it was planted on the machines, Wyatt did say it has again taken steps to prevent similar attacks from occurring.

“While we estimate that the incident affected a small percentage of payment cards used by guests who visited the group of affected Hyatt hotels during the at-risk time period, the available information and data does not allow Hyatt to identify each specific payment card that may have been affected,” reads the official statement.

Affected customers are strongly encouraged to closely monitor their credit cards in coming months and even call the hotel chain for more information at a list of designated hotlines for each affected region.