Hacker steals data in Wyndham hotel breach

Customers of the Wyndham chain of hotels have had their credit card details stolen after a hacker breached its database.

The network hack was detected in late January, and occurred from late October 2009 until its discovery, Wyndham Hotel Group said.

"Briefly stated, an unauthorised user took over an authorised account and used that account to acquire credit card numbers from certain Wyndham-branded properties," the hotel chain's director of media relations, Evy Apostolatos, said on Monday. "Fortunately, the incident was identified and quickly shut down."

The hacker gained access to one of Wyndham Hotel Group's datacentres by going through centralised network connections, the company said in an open letter to customers on 18 February. Credit card data was then systematically moved to a URL outside the Wyndham network.

The hacker was able to access and download information from a number of Wyndham hotels, but did not compromise the whole chain, according to the letter. The stolen information included customer names, card numbers, expiration dates, and data from the cards' magnetic stripes.

The hotel group became aware of the theft of information after customers complained that their details were being fraudulently used. Upon discovery of the data breach, the hotel group shut down the affected server and stopped traffic to the malicious URL. It also notified the US Secret Service and payments card companies.

Wyndham Hotel Group has not yet unearthed the extent of the breach or how many customer records have been compromised, said Apostolatos. However, an FAQ issued by the hotel group in February said that customers had been affected globally.

"We do not yet know how many customers may have been impacted, but we will be notifying all the appropriate parties and will provide free credit card-monitoring services to those consumers who take advantage of the offer," said Apostolatos. "We deeply regret that this event occurred."

The company is not aware of any UK customers who have had their details compromised, said Apostolatos. She added that there was only one branded Wyndham hotel in the UK, which did not have data stolen. "Wyndham Grand London Chelsea Harbour... is not on our list of impacted hotels," she said. "Only a fraction of the Wyndham brand's 94 hotels were impacted, and London was not one of them."

Wyndham Hotel Group consists of a number of brands, including Ramada, Travelodge and Days Inn hotels, but customers of these hotels were not exposed in the hack, according to the company.

Concerned customers can complete an online form to gauge whether their details could have been compromised, said the hotel group. Customers were urged not to enter any credit card details into the form.