Hilton confirms hotel credit-card-snaffling sales till malware hit

How many customers?

"The hotel chain is also keeping quiet about the number of people or credit card records exposed at a result of the breach."

The standard answer to this is obviously: "a very small number of customers"

Prepay all day long

Soo...

Are they blaming China yet?

Typical

Still no guidance to employees on how to handle guest inquiries if we're asked about this but I suppose that would require Hilton telling us that the breach had occurred.

Attack Vector

I had the thankless chore of reading through the PCI DSS requirements the other day, not a task I want again. If malware gets onto what is supposed to be a very isolated and restrcited system, what can it get at? Without looking into it I had always assumed that card terminals would encrypt your CHD on the terminal itself before sending that data to bank/processor/jargonofchoice. I'm guessing if malware on the POS can get at it thats not true, or is it in ther terminal too. That or the stolen CHDs have been extracted from the booking system instead?

been a while

I think it's been close to 2 years since one of my CCs was last compromised. I use them at many places including hotels(usually best western or holiday inn), airlines, online(using BofA "shopsafe" virtual CCs). For a year or two it was getting nailed 2-3 times a year seemed like (with most of those being "shopsafe" compromises which doesn't matter to me because nobody else can use those numbers, but the BofA fraud system last I dealt with it anyway couldn't distinguish between a shopsafe compromise and a main card compromise, had to talk to a rep who would manually clear the fraud alert after verifying it was shopsafe).

Maybe just been lucky I don't know.. outside of a brief trip to europe Target is the only place I've been to that accepts the "chip" on my cards(that have no PIN), other places tell me their chip readers(the few that have them) don't work(yet). I like swipe still myself, much faster.

Plausible deniability?

But Dear, despite what my card statement says, I did not visit Madam Lash when on that business trip!

Yeah - they like Steam

My daughter's debit card got hit the other night for almost $300 of bogus Steam charges. And yes, she used it at a Hilton during the period when they got hacked. Guess once the cat's out of the bag they sell off the numbers as fast as they can.