Computer hackers continue to steal hotel guests' credit-card data more than any other industry - and there's little consumers can do to protect themselves, Nicholas Percoco, an Internet expert who investigates corporate data breaches, tells Hotel Check-In. Percoco runs SpiderLabs at Trustwave, the security team that performs cyber forensic investigations for companies that suspect their systems have been breached.
I called Percoco recently for an update since we hadn't spoken since March. But coincidentally, since our last conversation, I may personally have become a victim of hotel hackers.
Back in March, my husband and I had stayed at the grand, historic Driskill Hotel in Austin for the South by Southwest music festival and ate in its cafe, paying with our credit card. Weeks later, we later received a letter at home from Driskill parent - Destination Hotels and Resorts - warning guests of a possible breach. We didn't think much of it until about two months later, when our credit card company's fraud department called to see if we'd really purchased $300 worth of meat in New York; since we hadn't, they closed our account to solve the problem. There is no proof of a connection, but we can't help but wonder if the two events were linked.
High-profile hotel breaches
The Destination Hotels case was written up last month by ABC News. According to the report, more than 700 Destination Hotels guests had their credit card data stolen. Austin police told ABC News that they learned of the breach from guests who saw odd charges on their credit card statements and from credit card companies that had observed unusual patterns.
Other breaches this year:
- The Westin Bonaventure in Los Angeles warned guests and parking customers that their credit card data may have been stolen between April 2009 and December 2009.
- In March, Wyndham Hotels reported its third breach in a 12-month period.
These higher-profile cases - and others that haven't been reported publicly - have made Trustwave extra busy.
The company performed more breach investigations on behalf of hotels in the April-June period "than any other previous quarter," Percoco told me.
"We've had a very, very busy last few months," he said.
After hotels, restaurants were the next-most-investigated industry for breaches, he said.
Hackers growing more sophisticated
Part of the problem for hotels is that hackers have been creating more sophisticated software. The new breed of software can sit undetected inside a hotel's network for months until an expert looks specifically for it, he told me.
"Once installed on the hotel reservations system, (the hacker) is able to go through all the data on that system and pull out the credit card information," he said. "They can look not only at historic data on that system, but also the data being input at the same time."
Typically, hotel breaches are detected only after a credit card company notices a trend over time, he said. The credit card companies may see a pattern where credit cards are legitimately used at a particular hotel - and then fraud appears on those cards "some time after," Percoco told me.
What are hotels doing about this?
On the positive side, Percoco told me that some of the larger hotel companies are starting to spend money to combat hotel hackers.
"The major brand-name hotels are being very proactive - more than we've ever seen in the past," he said. "Some have called us to do security testing so that...someone can't break in and steal consumers' information."
Some of the big chains are also starting to require their franchised properties to boost their individual systems' security.
Unfortunately, Percoco wouldn't identify any of the hotels or chains. And so far, none of the hotel companies that may be taking the hacker problem seriously has decided it's worth talking about publicly.
Can hotel guests protect their credit card data?
There's little that hotel guests can do to protect themselves other than to monitor their credit card statements after each hotel stay. For some road warriors, of course, that means scrutinizing statements each and every month.
It's not worth paying your hotel bill in cash because carrying large amounts of cash can present other risks, he said.
One tip: Don't pay your hotel tab with a debit card, he said, because an ambitious criminal might be able to drain your account of cash instead of run up charges - whether for electronics, designer clothing or meat.
Source: USA Today