Late yesterday (4th April), banking industry sources reported to KrebsOnSecurity that the Trump Hotel Collection appears to be dealing with another breach of its credit card systems. According to the sources, they’ve noticed a pattern of fraud on customer credit cards which suggests that hackers have breached credit card systems at some — if not all — of the Trump Hotel Collection properties. If confirmed, this would be the second such breach at the Trump properties in less than a year. Here to comment on this news is security experts from Rapid7 and Centrify.
Tod Beardsley, Security Research Manager, Rapid7:
“Today’s news that the Trump Collection of properties has been breached is eerily familiar. While it’s possible that the real story behind the breach could be anything from a disgruntled insider, to a breach of the core IT systems used in Trump properties, or some unique method of obtaining credit card data from Trump customers, the Krebs story sounds like many of the point-of-sale (POS) compromises that have recently hit major hotel and hospitality companies over the last 18 months.
I would be surprised if the techniques used by the attackers in this case were substantively different from those used against Starwood, Hyatt, and Hilton. We’ve seen that in the hotel industry, the POS systems are generally the weakest link in the IT chain, and technically savvy criminal organisations have clearly figured this out.
Retail companies, hotel chains, and restaurants should examine their own POS installations for common misconfigurations and exposures, such as default and easily guessed passwords, outdated software, and poor network segmentation.”
Chris Webber, Security Strategist, Centrify:
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.