HEI Confirms Data Breach Hit at Least 20 Major Chain-Branded Properties in U.S.
HEI Hotel and Resorts, which owns and operates nearly 60 hotels across the United States, has reported that at least 20 of its properties have been the victim of a malware attack. While the problem has now been contained, HEI believes that customer payment card data used at point-of-sale terminals at the affected properties might have been compromised. That data could include name, card number, expiration date and verification code.
The hotels that were hit are spread across 10 states and include properties flying flags from Hyatt, IHG, Marriott and Starwood, as well as some independent properties. The time of the breach varies by hotel, but stretches back as far as March 1, 2015, in some locations. A list of the properties affected, along with the dates in question, appears below.
Upon discovering the possibility that its systems were hit, HEI hired forensic experts to investigate the problem and set up a standalone processing system that was separate from the rest of the company's network, according to a statement from HEI. The malware has been disabled and HEI is continuing to review and enhance its security measures. According to the lodging company, customers can now safely use payment cards at all of its properties.
HEI is advising customers who used a payment card at the affected properties during the dates specified to monitor their credit card statements and report any suspicious activity promptly to the card issuer. More information about identity theft protection is available on the company's website, at heihotels.com/notice/1.
The affected properties and dates are as follows:
Hyatt Centric Santa Barbara; 12/26/2015 - 6/21/2016
Le Méridien San Francisco; 3/1/2015 - 6/7/2015 and 12/2/2015 - 6/8/2016
Renaissance San Diego Downtown Hotel; 12/26/2015 - 5/2/2016
San Diego Marriott La Jolla; 12/26/2015 - 5/2/2016
The Westin Pasadena; 3/3/2015 - 5/18/2016
The Westin Snowmass Resort in Snowmass Village; 12/26/2015 - 4/10/2016
Boca Raton Marriott at Boca Center; 3/1/2015 - 6/7/2015 and 12/15/2015 - 4/11/2016
Intercontinental Tampa Bay; 3/21/2016 - 6/15/2016
Royal Palm South Beach Miami; 12/23/2015 - 6/6/2016
Westin Fort Lauderdale; 1/29/2016 - 4/13/2016
Hotel Chicago Downtown; 12/26-2015 - 4/27/2016
The Hotel Minneapolis Autograph Collection; 3/1/2015 - 4/27/2016
The Westin Minneapolis; 9/2/2015 - 6/17/2016
The Westin Philadelphia; 3/10/2016 - 6/6/2016
Sheraton Music City Hotel in Nashville; 3/1/2015 - 6/8/2016
Dallas Fort Worth Marriott Hotel & Golf Club; 12/26/2015 - 4/28/2016
Equinox Resort Golf Resort & Spa in Manchester Village; 12/23/2015 - 5/4/2016
Le Méridien Arlington; 12/23/2015 - 4/28/2016
Sheraton Pentagon City in Arlington; 3/3/2015 - 6/7/2015 and 12/2/2015 - 6/13/2016
DISTRICT OF COLUMBIA
The Westin Washington, D.C. City Center; 11/15/2015 - 5/28/2016