Hyatt Hotels suffered a new payment card breach, the second in two years

The Hyatt Hotels Corporation notified customers that their credit card information may have been stolen by crooks, the second time in 2 years.

The Hyatt Hotels Corporation made the headlines once again, the company notified customers that their credit card information may have been stolen by crooks.

The data breach affects three hotels in the United States, 18 in China, four in Mexico, three in Puerto Rico, three in Saudi Arabia, three in South Korea, and facilities in Brazil, Colombia, Guam, India, Indonesia, Japan, and Malaysia.

“We understand the importance of protecting customer information and securing our systems, and we regret to inform you that we discovered signs of and then resolved unauthorized access to payment card information from cards manually entered or swiped at the front desk of certain Hyatt-managed locations between March 18, 2017and July 2, 2017. A list of affected hotels and respective at-risk dates is available here.” states the breach notification.

According to Hyatt, crooks planted a malware on payment systems at certain hotels to harvest credit card data from guests that physically entered or swiped at some hotel front desks between March 18, 2017 and July 2, 2017.

The malicious code allowed crooks to siphon cardholder name, card number, expiration date, and internal verification code.

“Based on our investigation, we understand that such unauthorized access to card data was caused by an insertion of malicious software code from a third party onto certain hotel IT systems. Our enhanced cybersecurity measures and additional layers of defense implemented over time helped to identify and resolve the issue.” continues the notification.

At the time, Hyatt is not able to identify each specific payment card that may have been affected by the data breach.

“While we estimate that the incident affected a small percentage of payment cards used by guests who visited the group of affected Hyatt hotels during the at-risk time period, the available information and data does not allow Hyatt to identify each specific payment card that may have been affected,” said Chuck Floyd, global president of operations at Hyatt Hotels Corporation.

Unfortunately, this isn’t the first time the company discovered a data breach, this is the second incident in the last two years.

In January 2016, the Hyatt Hotels Corporation announced a total of 250 of its resorts were compromised in a malware-based attack in 2015, hackers stole customer payment card information.

At the time of the incident, the company announced a significant enhancement of cybersecurity measures to protect its payment systems, but the actions were obviously not enough. 

Pierluigi Paganini


Source :

Given the complexities of digital financial world, let us put cybersecurity as core focus, for the leaks of data security can jeopardize the credibility and growth of the whole industry. For this reason, Asosiasi FinTech Indonesia fully supports Cyber Security Indonesia 2017 to create top of mind awareness on cybersecurity issue.

Niki Santo Luhur
Chairman - FinTech Indonesia Association

Now the whole industry begins to understand that it's better to prevent than to lose access and control data because of negligence to keep the data secure. Hence, this encourages APTIKNAS to endorse the implementation of Cyber Security Indonesia.

Fanky Christian
Head of DPD DKI - APTIKNAS (Indonesian ICT Business Association)

Indonesia, with its vast wealth of information is in urgent need of preventive and defensive measures against cyber threats. Other than protecting national interest, such measures are also required to protect the interest of its citizens. Actions taken may not be adequate through policies and regulations but through concrete actions involving all components of the nation. Hence LEMSANEG welcomes and endorses Cyber Security Indonesia 2017.

Major General (TNI), Dr Djoko Setiadi, M.Si
The Head of LEMSANEG (State Cryptography Agency)

ATSI (Indonesian Telecommunication Providers Association) supports Cyber Security Indonesia 2017 to encourage concern and awareness of the important needs of cyber protection system to prevent and minimise cyber crime for individuals, communities, governments and also companies in Indonesia.

Sutrisman Raden
Executive Director of ATSI