We have retained expert third-party advisors to assist in the investigation and are working with law enforcement. The unauthorized access has been shut off, and there is no evidence of continued unauthorized activity at this time. We are investigating an incident involving unauthorized access to payment information contained in a subset of hotel reservations processed through the Sabre Hospitality Solutions SynXis Central Reservation system. Recently, one of the larger CRS vendors – Sabre – reported an attack on one of their systems in a quarterly SEC filing. However, the amount of payment information that can be obtained with such an attack remains rather limited and can be detected by credit card companies comparatively easy.
Installing malware on payment terminals, attackers were able to copy the information from the credit cards and create copies of these cards. All of these attacks specifically targeted the payment systems. Recent events include attacks to Holiday Inn and Crowne Plaza Hotels, Hilton Hotels, Hyatt Hotels, and even the Trump Hotel chain. Targeted malware attacks against specific hotels and hotel chains are not uncommon. Additionally, these systems provide gateway (and payment) functionality for rail carriers, cruise lines, and car rental services. The two largest players here are the Amadeus CRS deployed in 440 airlines, 90,000 travel agencies, and over 100,000 hotels and Sabre GDS operating for 400 airlines and 88.000 hotels. They are deployed on massive scales comparable to operating systems and the variety of systems is rather limited. These systems have to be (and are being) protected by a multitude of defensive measures to keep criminals from achieving control or gathering data.Ĭentral Reservation Systems (CRSs), the systems behind your travel bookings, are a such an interesting target, as they process a high volume of payment data every second of the day. Especially, if these systems collect and process payment data.
Gathering control over large-scale backend systems is a tempting achievement for criminals.
0 kommentar(er)
