Hyatt Hotels hyatt.com Hyatt Hotels data breach: what happened and what to do
Hyatt said in October 2017 that malware at the front desks of certain hotels exposed payment card data between March 18 and July 2, 2017. The data was cardholder name, card number, expiration date and verification code.
View all 13,177 breaches- Breach date
- 18 Mar 2017
- Data exposed
- Cardholder names, Credit cards, Card expiration dates, Card verification codes
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In October 2017, Hyatt Hotels Corporation announced that it had found unauthorized access to payment card data from cards entered or swiped at the front desks of certain Hyatt hotels. The at-risk period ran from March 18, 2017 to July 2, 2017, depending on the hotel.
Hyatt's notice says the data was limited to cardholder name, card number, expiration date and internal verification code. It later attributed the access to malicious software code inserted by a third party onto hotel IT systems. Reuters, cited by Business Insurance, counted 41 properties in 11 countries, and Dark Reading reported 13 countries. Hyatt said it estimated that a small percentage of payment cards used in the period were affected but could not identify every one.
Hyatt said it contacted guests directly where it had contact details. Its advice was to review card statements closely and report unauthorized charges to the card issuer immediately.
This was card data, not passwords or identity documents. With a name, number, expiry date and verification code, someone can make online purchases until the issuer blocks the card. That is why the practical fix is on the card side: statements, alerts and a replacement card if the issuer offers one.
The filings Hyatt made with attorneys general count residents of single states, so they are not the total number of guests affected.
Sources checked: oag.ca.gov, krebsonsecurity.com, darkreading.com
Last verified against the official page:
What to do if you were in it
- 1
Check card statements and report unfamiliar charges
Look through statements for the card you used and report any charge you don't recognize to your card issuer right away. Ask the issuer about replacing the card. The FTC lists next steps at https://www.identitytheft.gov/databreach.
- 2
Ask your issuer about a new card number
If you paid at a Hyatt front desk during the at-risk dates, call the number on the back of your card and ask whether it was flagged. Issuers can replace the card at no cost in most cases.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls about this incident with suspicion. Don't click links in them. Go to the company's website directly, or call a number printed on your card or bill.
- 4
Set up transaction alerts
Turn on text or app alerts for every purchase on the card. Small test charges are often the first sign of misuse.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- Washington Attorney General , filed 12 Oct 2017 : 640 people
- Washington Attorney General , filed 14 Jan 2016 : 15 people
Timeline
-
Reported to the Washington Attorney General
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Hyatt breach?
Hyatt contacted guests it could reach who stayed at affected hotels in the at-risk period. If you paid at a front desk between March 18 and July 2, 2017, review your statements.
What did the Hyatt breach expose?
Cardholder name, card number, expiration date and internal verification code.
Were passwords or passport details exposed?
Hyatt's notice describes payment card data only.
Should I change my password?
The notice doesn't list passwords, so a password change isn't the main step. Check card statements instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
